Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target 2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe
- Size 302KB
- Sample260604-c2m2kaas2n
- SHA256 1dd5b8fc5b5d07c51fae42ee7412ac565dba5a939c117a801b6b32b49f41cf56
- MD5 7e8a6b94764ebe188997ec89c7ec2859
- SHA1 ab21efa5f070d25072cc908f90a568453ca0fa78
- SHA512 f6b426353f98165f34c7d8ff1cc88e519b9c458647ca2d3b8aa1e153defee80abf96af13f4c36cc0b5eea63594a09dea74206eb05401759f8c9c369b0cdabbb2
- SSDEEP 6144:eCq6wwZrxOpqa2J0nXeY+5JHAF0MxqahJSEru0zYUWKu+avkm2QidNLNFhD9w:Iwoqa2T55AFbrhJbCxIuTClNFh5w
- TLSH T1C164F05277F982BEE0F257328D527AA1D6F9E73509248D03B7900E0E9FB6641CB19363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
resource yara_rule behavioral2/files/0x001b00000002b3ff-6.dat INDICATOR_EXE_Packed_VMProtect - Executes dropped EXE 2 IoCs
pid Process 2204 NetmProxy64.exe 4616 NetmProxy64.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nekohl Srevies = "C:\\Users\\Admin\\AppData\\Roaming\\AFC-5-29-xin1\\NetmProxy64.exe" NetmProxy64.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nekohl Srevies = "C:\\Users\\Admin\\AppData\\Roaming\\AFC-5-29-xin1\\NetmProxy64.exe" NetmProxy64.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: NetmProxy64.exe File opened (read-only) \??\S: NetmProxy64.exe File opened (read-only) \??\P: NetmProxy64.exe File opened (read-only) \??\Y: NetmProxy64.exe File opened (read-only) \??\H: NetmProxy64.exe File opened (read-only) \??\U: NetmProxy64.exe File opened (read-only) \??\Q: NetmProxy64.exe File opened (read-only) \??\E: NetmProxy64.exe File opened (read-only) \??\J: NetmProxy64.exe File opened (read-only) \??\G: NetmProxy64.exe File opened (read-only) \??\I: NetmProxy64.exe File opened (read-only) \??\K: NetmProxy64.exe File opened (read-only) \??\O: NetmProxy64.exe File opened (read-only) \??\Q: NetmProxy64.exe File opened (read-only) \??\T: NetmProxy64.exe File opened (read-only) \??\V: NetmProxy64.exe File opened (read-only) \??\W: NetmProxy64.exe File opened (read-only) \??\N: NetmProxy64.exe File opened (read-only) \??\O: NetmProxy64.exe File opened (read-only) \??\I: NetmProxy64.exe File opened (read-only) \??\S: NetmProxy64.exe File opened (read-only) \??\W: NetmProxy64.exe File opened (read-only) \??\X: NetmProxy64.exe File opened (read-only) \??\M: NetmProxy64.exe File opened (read-only) \??\Z: NetmProxy64.exe File opened (read-only) \??\J: NetmProxy64.exe File opened (read-only) \??\R: NetmProxy64.exe File opened (read-only) \??\U: NetmProxy64.exe File opened (read-only) \??\Z: NetmProxy64.exe File opened (read-only) \??\E: NetmProxy64.exe File opened (read-only) \??\H: NetmProxy64.exe File opened (read-only) \??\L: NetmProxy64.exe File opened (read-only) \??\N: NetmProxy64.exe File opened (read-only) \??\P: NetmProxy64.exe File opened (read-only) \??\R: NetmProxy64.exe File opened (read-only) \??\Y: NetmProxy64.exe File opened (read-only) \??\G: NetmProxy64.exe File opened (read-only) \??\T: NetmProxy64.exe File opened (read-only) \??\X: NetmProxy64.exe File opened (read-only) \??\B: NetmProxy64.exe File opened (read-only) \??\B: NetmProxy64.exe File opened (read-only) \??\K: NetmProxy64.exe File opened (read-only) \??\L: NetmProxy64.exe File opened (read-only) \??\M: NetmProxy64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString NetmProxy64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NetmProxy64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString NetmProxy64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NetmProxy64.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe 2204 NetmProxy64.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2204 NetmProxy64.exe Token: SeDebugPrivilege 4616 NetmProxy64.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2204 NetmProxy64.exe 4616 NetmProxy64.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5156 wrote to memory of 2204 5156 2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe 81 PID 2204 wrote to memory of 692 2204 NetmProxy64.exe 7 PID 4616 wrote to memory of 692 4616 NetmProxy64.exe 7 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_7e8a6b94764ebe188997ec89c7ec2859_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Roaming\AFC-5-29-xin1\NetmProxy64.exe"C:\Users\Admin\AppData\Roaming\AFC-5-29-xin1\NetmProxy64.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
-
-
C:\Users\Admin\AppData\Roaming\AFC-5-29-xin1\NetmProxy64.exeC:\Users\Admin\AppData\Roaming\AFC-5-29-xin1\NetmProxy64.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AFC-5-29-xin1\NetmProxy64.exe
- Size 180KB
- SHA256 283c1aed803ff195fd9d2d6734dc0aa1f4dc23c0daf2976bde9aea1d864f5d87
- MD5 48df8722233f485ea6ea744f7e9adc84
- SHA1 a703a249a51313ccd9b35642ff021df3b4807a1b
- SHA512 708d55c82a6ed50e161d71c48612e1a5af9db7aa2bc9130433c4c9e9640175336406568891bc7ba61595d2824e390f00e57e02ea09d7a6afda746fa088ccdc43
- SSDEEP 3072:zlW3ImI+dM6jRDGZuSeH42CNnqSDDcGMrnqQFgSKCiT5/1o0o5X4Yl184:pW3pjRSZuTDSDDcnnzFgSco4T
- TLSH T198046C8AB36410FAD067C139CC92575AF7B2746A472457CF43608BBA5F237E1AD3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\AFC-5-29-xin1\mim_e2.txt
- Size 289KB
- SHA256 ee3e42960059b9aafc806dedd6649558cd601b45f87523a26901e643ef5d7d6a
- MD5 d695f5183df3fab33f2a897eb519d7f8
- SHA1 44e2ca6e4ef3d5beb7dba649e8d7f5ac6a3370e2
- SHA512 379eba70a9fdbb307704b2bc69b522d63a99b057524f2064ea48fd54feea0c49f6c4ee198a6d402ee5d01a12b5db6b1cfd66ca3c9a00a2f741ab0513ed076e08
- SSDEEP 6144:TbkJd9y8TmtoLXvRR572xjD4n7bdBLzpqd7qz:cJ70toLfD12xjD4n7t9
- TLSH T15854AFB4512C228AD973DFB9CC4F9B4B7660E106BB89B11F150609C971290BDF46BE3B
- MD5 SHA1 SHA512 SSDEEP TLSH