01a8a03a85b2b482c82ed146f9839209db7dbbcb0adee6749a0c5619790b13e2

General

Target
2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
Size 86KB
Sample260602-y64e1ae13p
SHA256 01a8a03a85b2b482c82ed146f9839209db7dbbcb0adee6749a0c5619790b13e2
MD5 12c93c0ed64cad19cafc7722bafb7fbb
SHA1 ba63eeb57d4ff83429b9538bc7dad9985edf1c73
SHA512 a0d2ef848eccb957340bb0e640f45f21663187238aa5252d314b03448724ee73917e8a7f6dc0fc8526077032000786c70fa1aead9ae919eaa2844edc69afef7d
SSDEEP 1536:9kMfAWC5NuKDuTU8N82x5PWfD3mAOXwl4MZ4C4M+TGu/D:T4RXuKDuTUM8aPWfD3Ewl4M6DMOD
TLSH
T1B4838E4336C884F2C75A117034A76B7FEBB9266023E25AC3AF41CD29586B572ED39343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b392-15.dat	INDICATOR_EXE_Packed_VMProtect

Loads dropped DLL 2 IoCs

pid	Process
3536	rundll32.exe
3536	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x001d00000002b392-15.dat	vmprotect

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sfcos.dll	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\sfcos.dll	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File created	C:\Windows\SysWOW64\systemp	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Mondayn.ime	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File created	C:\Program Files\Tuesdayn.ime	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File created	C:\Program Files\Wednesdaynn.ime	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File created	C:\Program Files\Sundayn.ime	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File created	C:\Program Files\taskmgrn.upx	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
File opened for modification	C:\Program Files\Saturdayn	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	3536	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3536	rundll32.exe
3536	rundll32.exe
3536	rundll32.exe
3536	rundll32.exe
3536	rundll32.exe
3536	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1632	2576	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe	81
PID 2576 wrote to memory of 4984	2576	2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe	82
PID 4984 wrote to memory of 3536	4984	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_12c93c0ed64cad19cafc7722bafb7fbb_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\sfc.exe
  "C:\Windows\system32\sfc.exe" /REVERT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files\Mondayn.ime",Runed
    3⤵
    - Loads dropped DLL
    - Modifies WinLogon
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 592
      4⤵
      Program crash
      PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3536 -ip 3536
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mondayn.ime

Path C:\Program Files\Mondayn.ime
Size 23KB
SHA256 0771cbfbed6dabe5b597f31663522f92e99c8fc4c96dfdbd65383f87eed92f9b
MD5 9f3d418bd43a2bb7a4791fe3c6509415
SHA1 80d304de021983979c52a29bedb66224e9caeead
SHA512 6b1a913246227820a4be00814977cbfb1dbb0318b5548561262ac0fbce797806ced8d2cb9e429c71fe45cee2dfe307a716cb7e83cf87e7a1e55b9217377aacfe
SSDEEP 384:jTIVMMc9Cg1vuNUy1UDbgsucJfXoQequzBVKwY1CrLOSBWY1ok8chKsfovykIxh:jTIVMMccgRaUAWgsuKDu9wwYgfFW8N8o
TLSH
T180B27D437AC884F5D8A701B120AB6F7EFAE21A7412E75F876F52DD2124532616E3B343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Saturdayn

Path C:\Program Files\Saturdayn
Size 111B
SHA256 a3d0fefa42ecd90ea1d44afb993e09adf6fe440058580523c6b0a210cf2e27c6
MD5 bcf4af2dbedd32216d0d295a8ba00ab6
SHA1 b90f2a404e9ef5d305eec3841603117f6aec3604
SHA512 8794a00bd159cb3c5e0b02bfff9ab86bc90e3ec36e862218c30714b1cee88ebaa80cbe31126e5c4fda7f5c34ca011f1ec828abbfc0d32be0d7a6f867c7071ae9
TLSH
T1A3B09206A432AA0C49D6A29879294C8096582479619BA526919B61E6F4D44308769822
MD5 SHA1 SHA512 TLSH

Submit Download

sfcos.dll

Path C:\Windows\SysWOW64\sfcos.dll
Size 19KB
SHA256 34d589879b43b0ccfd5417fec753251ab791240522471f4e2b1b401c0e28acae
MD5 d81c22fd78b75fff591494aa147392d2
SHA1 5dfad830b6495409205cbdaab8035557fc76cb31
SHA512 9bf4b290e0332a6d47c3ef868337df98067f275f233f8f8ceee20087688a1c7ccb44af1d3265f77a5a00804309c52b4245dd25c715e7804bbdc226a53f0c4e4a
SSDEEP 384:Yk+h1A6jEWa0TIFWd8WSS0zbDBRJ+SqslGsgCY:q14WLIUO1PIRX
TLSH
T1EF923B82A7588563DAEA6EB03199F5173E3C5FC11B5040E748C3A5E91CD37C2AF34A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemp

Path C:\Windows\SysWOW64\systemp
Size 4KB
SHA256 78a84625500c495070b264e20cb5ce802706e80710b17a858d30fa1d63dfc4a4
MD5 10f2d48330c3a250a15320c96eb70816
SHA1 72f15d4894fb626678ad4c3d96b26c831d120bfa
SHA512 9aee2807aa2dc8d5ca2b2d24c928a75d86b12b244c1710ff12d59786ffa63f9fd76692a6921fe1506b80dc4236851f14d5af4a0a4aa97b4af447186b54d34dd3
SSDEEP 48:allb7yJydQU5lD+YRnmjptcXtpu+Tc1udCf2HCjZ2BcD:8y8HB9RmYpuyCO3BA
TLSH
T11A917232AAC045F2F4590A73665222F378F37AB457B610495F428A257C12B76ED2E703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path \??\c:\del.bat
Size 293B
SHA256 65be378f6fd34713fb97aaf6bb52058c5edaa9b7f4b942c9d5f6ef1209376f7f
MD5 be5fb5027dc322b26ce9c4299bf97c25
SHA1 5407cbb96d71dc020ceb035f644ed9b914c899d7
SHA512 dbd3eba6d8fac5066f558da7e7cdb5693679a2149488e8bfeef100e35b63edb83d23b4a0b789fc2a34761abc75c90c0866d330f51b01ab347beb86034cd95429
TLSH
T142E0CD00C16A72A66C417E575F5CB90D90116C1C2E5737751BC289C5718585DF59E741
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads