Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 14:32
Behavioral task
behavioral1
Sample
2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe
- Size 798KB
- Sample260629-rwkrkshv4r
- SHA256 778fd59a8bb444a03ffb22ccf87c9af08f678261eb006d65797b226a47473f1f
- MD5 80f0e006f35a70aaf88e2856d9294332
- SHA1 c84a244198081faa495d723b85af921e2a8ff68d
- SHA512 e5b31efa66982e8b965191df6069d39c174e46ab61b8ba1feb1018f535006f77c82520fe271d42f634b0769e829f1533283b17921ccafe7b7f04f299eb9689bf
- SSDEEP 24576:Uj0JJ4p/A4npt3XJjeQG5EtzRtO7GvmDguXd:UjoJ4u4zJjegylDN
- TLSH T109059D133D81807FC2750571C98A1BB6FAF7EE940E798D436388BE3C5A76D01EE16629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 11 4752 rundll32.exe - Loads dropped DLL 1 IoCs
pid Process 4752 rundll32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification \??\PhysicalDrive0 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7881AE6B44E7DB4123D6EDC7CD4400A7 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7881AE6B44E7DB4123D6EDC7CD4400A7 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe - Modifies data under HKEY_USERS 11 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 79faa3f10662c2c3871fc3033b32e56dc2f08ee31bf28a058b83a03f7ad97582f99e1d07496b25248e1eefc58719ffdb3773e08973583750dbd056a9af8fb26ea65b19892e8ff231e7cdd4 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 4752 rundll32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3584 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3584 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1464 wrote to memory of 3584 1464 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe 88 PID 3584 wrote to memory of 4752 3584 2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe" -service -lunch1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_80f0e006f35a70aaf88e2856d9294332_cobalt-strike_elex_hacktools_wannacry.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AMMYY\aa_nts.dll
- Size 902KB
- SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
- MD5 480a66902e6e7cdafaa6711e8697ff8c
- SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
- SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5
- SSDEEP 6144:k48nSSV5KZLH3BZ68sueOj3YYVmeaXwxlGhfjDVxShWqCGYywD+jWLEEI4vso6hV:kMZLHxZFUYwe9GVfbyvqMoiE
- TLSH T13D155CAAE1D36084D836887D6AD770F174127C6B9978B93A6B80CBE43D40B5077EFB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\AMMYY\aa_nts.msg
- Size 46B
- SHA256 41e2163a70accc90092be11c5db8967e6ef04d00d845fb2dc24e3cb572cd0571
- MD5 0025c45ae8e2391f3464e95794f0faae
- SHA1 2f476119f0362d10921f61a4514481914920cfa9
- SHA512 f4d3e03a6cd4d35795903c606c8bba5b0cedccf81593000b981c5ea22a8510547da7e6c774f858adf52fcef5b66fb09a210ff88cfb30c6a2f308fcbd9be0ff58
- MD5 SHA1 SHA512
- Path C:\ProgramData\AMMYY\settings3.bin
- Size 334B
- SHA256 a8da8560ef00d79a4c764f681b774ba479564085d59e19be39f95bfeff015729
- MD5 20392c2aeadf650d92745960e5a07479
- SHA1 ee2d61b2efdab5550741777c92c8707add053fd5
- SHA512 48972deb5a0db2592d3e6073db95e9b312880315bb6873dc6b7c3ed1747f6fedae81b5df7a0cb2d3b562c41beaa6860d3619f7e99d4e68e90459a6b919109ad4
- TLSH T107E0C09B94F24C2663058D26228101B9D50981260900B62F56F54B91B3274471C649B1
- MD5 SHA1 SHA512 TLSH