a8c24ba54459850ff810d3ef10e37e22b7beec12cf1a76af6c3e402f34042821

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_90fc2c2da62721c2c3155b6b807a6c20_elex_wannacry.exe
Size 260KB
Sample260602-efbgradt7v
SHA256 a8c24ba54459850ff810d3ef10e37e22b7beec12cf1a76af6c3e402f34042821
MD5 90fc2c2da62721c2c3155b6b807a6c20
SHA1 97a5d3f35441038b69e7ad5af49f0ab5a9e8b5f4
SHA512 f5b2058b7b7bf88e0508a8064a32d09468b45898a9eb1298d2ffc933a3ef08fe453e2b03d0353b3cb536f62b910b4170bcdbfe4c531831284d99fdc0d4273e14
SSDEEP 1536:pILFkbeumIkA39xSZW175V7UZQJ0UjsWpcdVO4Mqg+aJRaCAd1uhNRBo+EwMmN0T:pLRkgUA1nQZwFGVO4Mqg+WAl5MKVCdhk
TLSH
T158447017BE808035E4A10D310A25EBAD672A7818C8574E9736903EDFFFF1AC59F25636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5668	Infect.exe

Drops file in Program Files directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	Infect.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	Infect.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Infect.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	Infect.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	Infect.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	Infect.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Infect.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	Infect.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Infect.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	Infect.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	Infect.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	Infect.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Infect.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	Infect.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Infect.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	Infect.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	Infect.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	Infect.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	Infect.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	Infect.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	Infect.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	Infect.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Infect.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	Infect.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	Infect.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	Infect.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	Infect.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6136	5668	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_90fc2c2da62721c2c3155b6b807a6c20_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Infect.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 5668	5544	2026-06-02_90fc2c2da62721c2c3155b6b807a6c20_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-02_90fc2c2da62721c2c3155b6b807a6c20_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_90fc2c2da62721c2c3155b6b807a6c20_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Users\Admin\AppData\Local\Temp\Infect.exe
  C:\Users\Admin\AppData\Local\Temp\Infect.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 340
    3⤵
    - Program crash
    PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5668 -ip 5668
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 379KB
SHA256 6254d7ade54ef810ae242130517106550573c631db17de9f470369f8ab2be710
MD5 0ab4cb1c6b6220e0f9e797b1c16560f9
SHA1 6830d610a7d806a1755bba3f8f35121d0a6cafe0
SHA512 498eb867ef7203a2d56c40370195cbb19eceb613293bad8acef63128e1892e3eb66ffd44d1e92ef1b9563f043b17ff5010445a363f75d9e3223265652efa7c27
SSDEEP 6144:cWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjnl5MKVCdo:cAwSfxL/2Dc3jDLLmt0LDQewsAjlL
TLSH
T1C9847C31FFB4E036D2BB0DB21B2AC716543D79204B661AC3E3E88D9D59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 35KB
SHA256 2c90d2decf1e1398807b212d53f5485ba5b73f702b8ce40c99bb69cb0d5201e6
MD5 07cc8f508f7fe1998ce8fe4568028b54
SHA1 b088a822b569d4e7db72a5fa6ad7124e29372883
SHA512 685da8b4f8769597680b7fe70a16472a0ac4d7d16d9ebdaef1a13cfe47cbf3298350bedac69bc9fae318f3382d4f182135290d96781d4377e50003106d4f8c18
SSDEEP 768:73fDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhK:HwMmN0MKVCdhK
TLSH
T121F2C662AFDAE4B8F49141B0440E6FFEA56B50A5C26F5DCB57808C49083225DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
Size 35KB
SHA256 8c64e6ca7011d87dfb28e062a4e8c50ab5dc588536cd3e630cf42145c571d96a
MD5 8ac06809a0daa8186008e9fe164f003c
SHA1 0e720e0b9cb5571051f64763bb21ba19724f9018
SHA512 ee9f7819f1c50bb4061a366549cb2240bc38c66bca5b1897a2318117a26d47694671960ff9696e41e88ab0363f7aaa455fc1d6c4f1b1627d537e5278988aca27
SSDEEP 768:7wfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhe:0wMmN0MKVCdhe
TLSH
T16CF2D666AFDAE4B8F49141B0450E6FFEB56B50A5C26F5DCB57808C08083225DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
Size 35KB
SHA256 1d1ad93d1af85cfd34ff7352433b534ae7c1414f106684fda54b5b1c678ece8f
MD5 e70c9b936e08d3e2fe725a00092a0ea3
SHA1 1b1e76cdb68e603ddcff1fb27827d6d3ed5fe018
SHA512 69cfdd9a2064deebd220e6dd87cd23c6ccfb05f6379393e11bb7f318ea245d1fb5d4c068c78993120369c329fc212e0a7efe665cd0e1224a3dd995144bff750c
SSDEEP 768:7chIfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdh+:MYwMmN0MKVCdh+
TLSH
T11DF2D666AFDAE4B9F49142B0010E5FFEB56B51A5C26F5DCB57808C08083125DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSPPREARM.EXE

Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
Size 35KB
SHA256 e97b50d1104216d437c520e3bbe28c9dbd84cde064f61c20c70cade6d683e374
MD5 aed1e377f85c8d0cda9cb06442d3d18b
SHA1 89af0154ebbf59ab672d6357083afa40c52d3f86
SHA512 644927c37fd17562f62f70d5de6f50e6d35fec02cdb1a8052eef9a084344a4de08328b1dc7a8e59bb2d3174bf2bef101508e1bc594361979d1e0983b29a4afdf
SSDEEP 768:7VfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhA:1wMmN0MKVCdhA
TLSH
T1D0F2C666AFD6E4B8F49142B4410E5FFEB56B50A4C26F5DCB57808C09083225DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate32.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
Size 35KB
SHA256 d978ca8e16cdb90fc805c4951e2d72639025b016f76b6ce6a9c92f12fc4d1777
MD5 29addf769bb5c052688b36dd8b5107d9
SHA1 8b12333d32cdb0d64e49777896c27800330764da
SHA512 4954460b9bfa68672e53436b7bc74a145fa617652b8f9a68b329305d5d4519e21dd79efdde35f20a40ce158b1c80707a3cd6642adbfa80721c4d32acfd0eb198
SSDEEP 768:7BfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhVg:JwMmN0MKVCdhVg
TLSH
T1DBF2C562AFDAE4B9F49141B0041E6FFDA56B5065C36F5DCB57808C08083229DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVDllSurrogate64.exe

Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
Size 35KB
SHA256 4b62e312a2f3752b7eefde94770a8d2c932494be6375ef1abc4b723baed430e8
MD5 ee5b11c849d5e475340e656e2d373f75
SHA1 1db3fe358f7419157b0f561a4a3d0c80be98be34
SHA512 b857378be723f5f61d16faf54f2b667406db35798f4020a19c660c85a05f2fdd8b4d0acde9915e86c240b91fdcd77a7be6e54544b1d166868050cb1c255defb7
SSDEEP 768:76ASfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhog:CwMmN0MKVCdhog
TLSH
T1AFF2C666AFDAE4B9F49142B0410E5FFDA56B10A4C36F5DCB57808C09083229DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infect.exe

Path C:\Users\Admin\AppData\Local\Temp\Infect.exe
Size 32KB
SHA256 cadf3f7113421f900f4fcdceaf4bb9f2b020e77743d65add723154650293d0f8
MD5 d67c3f38dcfed20aaf83840c64703e86
SHA1 79da8b58de13795f646a5332dbb1157f5260941c
SHA512 a8b756f75d2c0cd272d8550f88a148d0d5f73cd4e277f07854776b992c5b6030cf347ca90ff69b7c18c13249c46dc91520bb6c7bc77cbe6165338b76ec2336c3
SSDEEP 768:OfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhy:+wMmN0MKVCdhy
TLSH
T1ABE2C466AFDAE4B9F49102B1000E6FFEB56B50A4C26F9DCA57808C18087125DFF3A15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SFT473.tmp

Path C:\Users\Admin\AppData\Local\Temp\SFT473.tmp
Size 35KB
SHA256 dea063a220045e779d60792f34e0c0346e7eff350d1fdd49b8bcac8b8fe4ad0d
MD5 f2d04797789f4db6b6a3bdf66bda53be
SHA1 273d0e8bb3da52707976fbd94e3cde571dd28910
SHA512 f61175688214396ecef4693e85b8862eeea8370dbb1e08e0e847e978bb10de6932d290d3b78a7f125ba2c51295a1d6d14a8133bbaeb358cde249604670421420
SSDEEP 768:7UpfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhLg:CwMmN0MKVCdhLg
TLSH
T19CF2D7A2AFDAE4B9F49141B0450E6FFDB56B5064C26F5DCB57808C09083225DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SFTEDE7.tmp

Path C:\Users\Admin\AppData\Local\Temp\SFTEDE7.tmp
Size 26.6MB
SHA256 6b19ca5df3152a3ef99282cd0771ef0ede05d361e08945716785d44ed5b5ca43
MD5 861594c03e4c6fd1bafdb68af7fc7a50
SHA1 321e2821d36061cd9f2fdaa6e60e5aa138a769e6
SHA512 14bd207fdc28755d6721e2cb15d17a588c61eb5bb57d4e813d9d5538da543ed6401267b1905b0e96c48b28f5046671c71b96940c0a74189f38a66dc71252044c
SSDEEP 393216:pw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXn:pWO1c877xqpyovvVWJ6VFK+q3cSvXn
TLSH
T1AC572292BBE89071F0F31630BA78567E457BBC215B31C1DF2286F61C16709D19A7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SFTFA7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\SFTFA7C.tmp
Size 35KB
SHA256 4a5afef01f632f87e8c61295336825e16676d7137c599e097fd359749babadb7
MD5 4992607d44e7877cd1c41346ce6af9f4
SHA1 927d523fc49483e6e9200358deda6498508e87c6
SHA512 88ca0cfe2aa00671d0746fa15738bfcb2e98a26d4c2612d404bb0444dd256c14a323d3caf163a9bb76a8e998cf51471fd60d9f428958b9bea9a06cb273d7fb35
SSDEEP 768:7pVfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhj:PwMmN0MKVCdhj
TLSH
T15EF2D666AFDAE4B8F49142B0411E5FFDB56B5064C26F9DCB57808C09083229DFF3A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5544-12-0x0000000000200000-0x000000000023D000-memory.dmp

Download

memory/5544-1-0x0000000000200000-0x000000000023D000-memory.dmp

Download

memory/5668-13-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-27-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-135-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-41-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-118-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-208-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-104-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-94-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-73-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-308-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-60-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-331-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/5668-339-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads