7f04c2c3b7b61c345aac178f49dc49d1778f90655e4d506b7691e91968c28136

General

Target
2026-07-13_a108169930080abff596196ffa2cfc0d_elex_wannacry
Size 12.9MB
Sample260713-kkbk7set7j
SHA256 7f04c2c3b7b61c345aac178f49dc49d1778f90655e4d506b7691e91968c28136
MD5 a108169930080abff596196ffa2cfc0d
SHA1 91188abe377b0ac5d2e78f0244f1cdb3f263073d
SHA512 296d329f3b0bf65891dd249c502ea91c494a7dc36b5146503b8569d389b47b18f3ed8edb5563671507caa6544cccf4f968cca25caf0aebcb66d36bd21b7052af
SSDEEP 393216:b1FHFwcudBWT3k7cF9KLfC5oKk70xkOHDn2:fqcunQaKTkYxkyn2
TLSH
T1E6D6334172BA157BC34B3175802BBE0C11F313150F7B645F4B68E5A32EBE1D2ABAE685
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-13_a108169930080abff596196ffa2cfc0d_elex_wannacry
- Size 12.9MB
- SHA256 7f04c2c3b7b61c345aac178f49dc49d1778f90655e4d506b7691e91968c28136
- MD5 a108169930080abff596196ffa2cfc0d
- SHA1 91188abe377b0ac5d2e78f0244f1cdb3f263073d
- SHA512 296d329f3b0bf65891dd249c502ea91c494a7dc36b5146503b8569d389b47b18f3ed8edb5563671507caa6544cccf4f968cca25caf0aebcb66d36bd21b7052af
- SSDEEP 393216:b1FHFwcudBWT3k7cF9KLfC5oKk70xkOHDn2:fqcunQaKTkYxkyn2
- TLSH
  T1E6D6334172BA157BC34B3175802BBE0C11F313150F7B645F4B68E5A32EBE1D2ABAE685
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer upx
- UPX dump on OEP (original entry point)
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2