2a334168560f1d23414b85ebd81ae53d6aac0d811c685cd3387a8fa831f3fe82

General

Target
2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe
Size 89KB
Sample260705-tml96adx7z
SHA256 2a334168560f1d23414b85ebd81ae53d6aac0d811c685cd3387a8fa831f3fe82
MD5 52bce59c22dc78e967ab00b0a13de1a9
SHA1 db8d3ef7d02d1d4a5aa43621e097948e38cf5e1c
SHA512 a661c686289c81018b48c165bf3f2439971952019cb209bcd2f79b2924ea34672c1114e1ee138db2e86945c77d2f373b602efdaecb21d7c927dcf0e6b1c3f5f3
SSDEEP 1536:nj2AwKrSEqxQxK+oyEIXQ7+JLIzbPhwSLJx/9fRXOUhiUW6gt:j2AwNc0AXQ7+crmMJv4UzWN
TLSH
T13393F187F89745A6C4213AB411866B32CA57A295C041E082DF35FE90F8FF2ADD41EF97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
616	eidolon.exe
3368	2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe
2580	USBServers32.exe
2072	USBServers32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\USBServers32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\USBServers32.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBServers32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 616	2076	2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe	88
PID 2076 wrote to memory of 1200	2076	2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe	89
PID 2076 wrote to memory of 5880	2076	2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe	91
PID 5880 wrote to memory of 3368	5880	cmd.exe	93
PID 5880 wrote to memory of 2580	5880	cmd.exe	94
PID 2580 wrote to memory of 2344	2580	USBServers32.exe	95
PID 2344 wrote to memory of 2236	2344	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\eidolon.exe
  "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Users\Admin\AppData\Local\Temp\2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_52bce59c22dc78e967ab00b0a13de1a9_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
    "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2236

C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
1⤵
- Executes dropped EXE
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USBServers32.exe

Path C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
Size 54KB
SHA256 8f53ab3cd172f685568e0cbb51eb7dfd2389a5fe6aaf47d0aa7d823253e673ee
MD5 6428b1de8971e837926de5b464725f64
SHA1 19d7ce6fff617b790f9de7bf99406e61061f0594
SHA512 7938b01ce48bcdd3276c83f82fc71407d101f2e884b3f271a17fcf4c60af642faf57047edab97906351217f79847107757283af3fbfc3059cf4eb8e8d778d026
SSDEEP 768:nj27aTwKrJgJapOgV0jvQbtgDDM1MEprbhrCTyYrKjA70QkwWyit3JvsgZaphsL7:nj2AwKrSEqLQxK+oyEIXQ7+JLIzbPhwj
TLSH
T1D643D083BA8688E2C410357025977B32CA176FD25085F4A6EF31FDA0E4FF15A942DE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\Temp\tttbrozzz.bat
Size 598B
SHA256 ca383aba381abcd36ce44c3fbee0f66ea71b3f76009c97fb7528b3625359cca0
MD5 21346a18aee611b3519475101eb4a8c8
SHA1 fd556f0a168b01394c39577c78cf570dbd2d1080
SHA512 5566939d6a10476d9462de91004b00a00767386314a381e01c98541725c768beb53b95d1d803988c762d0d4dfafa4b5f4120c7d85e68eefc2a8e01c02a028319
TLSH
T1C0F02D2952A6C6EAD87891130BEA6A0DD161E466FF581B100F24C64A61E180FFF93643
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\Temp\tttdelzzz.bat
Size 313B
SHA256 4c04069fdef7205bb938dc064bb4f4dd610a0aa1b196f45582d79f1df8189e7e
MD5 9bbab0bef8b6e083c2ba8e529e7fb9ca
SHA1 5cee8eb934ae1f8f007bb3da0047c4e3fdc4fa7d
SHA512 7c968b6fb53f93e2813b5f7c8e266d2e4b36ab523cec0243fa2a79cbb3bc61fca4cc003bca6e71f6b8859afe14212cee3fc63e9166d5400a4f777e08f75d0d0e
TLSH
T114E07D3C36B556C7DC38501347EE2E09C155F4976F1907110F24C65191E140EFE83A83
MD5 SHA1 SHA512 TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 33KB
SHA256 f8bf54ea67aa1a4e412af1b10f45588169e8fa74aaafeacf62a32e7ce418661a
MD5 ac057477a6c8026ee7abae71da69b786
SHA1 614c39f597b46b46b54c4b859cbd5490e2d09458
SHA512 7fb29391e3cc8e6e0d8c20d1d7a2e65ffdab9d78454207c9a1f2831fb54df70e36224cce84764b6489ddc8587ae541ab62a0f1060c757659aae28909eb0a58cb
SSDEEP 384:XhiCZ04RJfm3PvezAUPKbBu+DIYijyCDMK4i/8E9VF0NyGHwIgIYijyfw4i/8E95:304RdmAFHYiu8PeEjuYiuYeEGG
TLSH
T1C3F25D1389985C01CD9B4EB034F4CA269D7977976BD082D7232EC1544F963817EFD2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads