c1c685dd30a7b737bc176531afa57bdb3a67b7c3c440c16621fc25e2ed926e26

General

Target
2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe
Size 26.8MB
Sample260712-per38abw21
SHA256 c1c685dd30a7b737bc176531afa57bdb3a67b7c3c440c16621fc25e2ed926e26
MD5 97c6423b9c3422f96397100ca48170ad
SHA1 4cd09a542857dcfdc4e6ad08c44a11c886daae59
SHA512 45161ba2431f01b319ba46ab7287cb73d4f4da811834f7127281a346905ad97a13d52f7189c069578440e4f968fb6876166a2da13acb40fae04fe8660034e49d
SSDEEP 786432:IltVreuaGPg5KBfdlJ088r9p8TYzXeYx2DrOuATTs:SUua55KdDvz+Vx22RTTs
TLSH
T1175733156EC0853ACAD471BE841C2B4136CBE6D0BD435E8A8B1BDBC375CEA5FCA49784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

adware discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	打印机驱动安装.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	打印机驱动安装.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync	打印机驱动安装.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	打印机驱动安装.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	打印机驱动安装.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	打印机驱动安装.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAuditPrivilege	3608	svchost.exe
Token: SeSecurityPrivilege	3608	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4060	打印机驱动安装.exe
4060	打印机驱动安装.exe
4060	打印机驱动安装.exe
4060	打印机驱动安装.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4060	1704	2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe	86
PID 4060 wrote to memory of 2152	4060	打印机驱动安装.exe	87
PID 4060 wrote to memory of 3540	4060	打印机驱动安装.exe	88
PID 4060 wrote to memory of 3732	4060	打印机驱动安装.exe	89
PID 4060 wrote to memory of 4048	4060	打印机驱动安装.exe	90
PID 2152 wrote to memory of 3820	2152	net.exe	95
PID 4048 wrote to memory of 2504	4048	net.exe	96
PID 3732 wrote to memory of 1536	3732	net.exe	97
PID 3540 wrote to memory of 748	3540	net.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_97c6423b9c3422f96397100ca48170ad_elex_hijackloader_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\HP_DJ_2700_Series\打印机驱动安装.exe
  "C:\Users\Admin\AppData\Local\Temp\HP_DJ_2700_Series\打印机驱动安装.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\net.exe
    net start spooler
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start spooler
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
- - C:\Windows\SysWOW64\net.exe
    net start stisvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start stisvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:748
- - C:\Windows\SysWOW64\net.exe
    net start DeviceInstall
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start DeviceInstall
      4⤵
      System Location Discovery: System Language Discovery
      PID:1536
- - C:\Windows\SysWOW64\net.exe
    net start DsmSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start DsmSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\HP_DJ_2700_Series\config.ini
Size 234B
SHA256 21f04d64c04ccd1a7aa4d3e5a9a6663d7951da3533c0facc64abf965f4e8e3aa
MD5 b4b711596402c951368af0f77ebdb66d
SHA1 e7f7407599061c7fa12d5d4f66a3e3cc5f045c5a
SHA512 5c82ab8f9bf700c7b58b7cc2f8d3d2ab718cfb1fffa7991951f761ee52aecec178595c48de3a8a33cfe2075f2a7ab6f0dd00c401e905c335b2f77a0c2244a647
TLSH
T120D0C9087811E6E3976EB26DB37391D1651AC504B8756341DEDFA4C20D2498CF39D46B
MD5 SHA1 SHA512 TLSH

Submit Download

打印机驱动安装.exe

Path C:\Users\Admin\AppData\Local\Temp\HP_DJ_2700_Series\打印机驱动安装.exe
Size 1.2MB
SHA256 1fe2918fac6b55f7b7ab33791cd6492015aff7ccc1364b63d28ce2aa95136a83
MD5 60741dfbb32a6f407bfdc187656a2696
SHA1 ffbc58973fcf5e141eae966cb8a0a56098211366
SHA512 9041aa2437c4daeb06a2b2e62520e07d9a3dd325196bd81661332a33fe6eb6711491ecf34153c7fdd9c7998a32eb0cde7dda799749ac763621b8d2f1c422e93b
SSDEEP 24576:4s23iesY80z5zb+Ao3mW2cB2dC5zjBGLkbOF0DXc6TynNkN6o4lVW/+gwv0Xl7jd:t6h80z5zb+Ao3mW2cB2dC5zjBGLkbOFs
TLSH
T117551710F19041B3E0D61CB0B989F4A5FC4922947FDEBA93BEA6C91DABB5DB0512443F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads