Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 04:30
General
- Target 2026-07-16_459e560f30acc45b2301f941e11d664a_elex_wannacry.exe
- Size 38.0MB
- Sample260716-e48r6agv8t
- SHA256 ee8bd94c079b86e4c435398a9e8c41351fc82e487d20e554d0c72e2ef52068bc
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 18 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_459e560f30acc45b2301f941e11d664a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_459e560f30acc45b2301f941e11d664a_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS856A6D19\java\bin\ExboInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS856A6D19\java\bin\ExboInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\ffffffffe8918110.timestamp /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ffffffffe8918110.timestamp
installer.jar
args.txt
ExboInstaller.exe
MSVCP140.dll
VCRUNTIME140.dll
awt.dll
fontmanager.dll
glass.dll
java.dll
javafx_font.dll
jimage.dll
msvcp120.dll
msvcr120.dll
net.dll
nio.dll
prefs.dll
prism_common.dll
prism_d3d.dll
jvm.dll
verify.dll
zip.dll
java.security
COPYRIGHT
LICENSE
LucidaBrightDemiBold.ttf
LucidaBrightDemiItalic.ttf
LucidaBrightItalic.ttf
LucidaBrightRegular.ttf
LucidaSansDemiBold.ttf
LucidaSansRegular.ttf
LucidaTypewriterBold.ttf
LucidaTypewriterRegular.ttf
jvm.cfg
modules
tzdb.dat
tzmappings
memory/2400-446-0x0000000003178000-0x0000000003180000-memory.dmp
memory/2400-537-0x0000000003220000-0x0000000003228000-memory.dmp
memory/2400-450-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-452-0x0000000003188000-0x0000000003190000-memory.dmp
memory/2400-451-0x0000000003100000-0x0000000003108000-memory.dmp
memory/2400-455-0x0000000003190000-0x0000000003198000-memory.dmp
memory/2400-458-0x0000000003198000-0x00000000031A0000-memory.dmp
memory/2400-457-0x0000000003158000-0x0000000003160000-memory.dmp
memory/2400-461-0x00000000031A0000-0x00000000031A8000-memory.dmp
memory/2400-448-0x0000000003180000-0x0000000003188000-memory.dmp
memory/2400-460-0x0000000003160000-0x0000000003168000-memory.dmp
memory/2400-445-0x00000000030E0000-0x00000000030E8000-memory.dmp
memory/2400-443-0x00000000030D8000-0x00000000030E0000-memory.dmp
memory/2400-440-0x00000000030F0000-0x00000000030F8000-memory.dmp
memory/2400-474-0x00000000030F8000-0x0000000003100000-memory.dmp
memory/2400-475-0x00000000031A8000-0x00000000031B0000-memory.dmp
memory/2400-476-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-478-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-480-0x00000000031B0000-0x00000000031B8000-memory.dmp
memory/2400-483-0x0000000003168000-0x0000000003170000-memory.dmp
memory/2400-484-0x00000000031B8000-0x00000000031C0000-memory.dmp
memory/2400-441-0x0000000003170000-0x0000000003178000-memory.dmp
memory/2400-438-0x0000000003168000-0x0000000003170000-memory.dmp
memory/2400-490-0x00000000031C0000-0x00000000031C8000-memory.dmp
memory/2400-489-0x0000000003170000-0x0000000003178000-memory.dmp
memory/2400-493-0x0000000003178000-0x0000000003180000-memory.dmp
memory/2400-494-0x00000000031C8000-0x00000000031D0000-memory.dmp
memory/2400-497-0x00000000031D0000-0x00000000031D8000-memory.dmp
memory/2400-496-0x0000000003180000-0x0000000003188000-memory.dmp
memory/2400-500-0x00000000031D8000-0x00000000031E0000-memory.dmp
memory/2400-499-0x0000000003188000-0x0000000003190000-memory.dmp
memory/2400-501-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-504-0x00000000031E0000-0x00000000031E8000-memory.dmp
memory/2400-503-0x0000000003190000-0x0000000003198000-memory.dmp
memory/2400-506-0x0000000003198000-0x00000000031A0000-memory.dmp
memory/2400-507-0x00000000031E8000-0x00000000031F0000-memory.dmp
memory/2400-435-0x00000000030A0000-0x00000000030C8000-memory.dmp
memory/2400-436-0x00000000030E8000-0x00000000030F0000-memory.dmp
memory/2400-433-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-518-0x00000000031F0000-0x00000000031F8000-memory.dmp
memory/2400-517-0x00000000031A0000-0x00000000031A8000-memory.dmp
memory/2400-521-0x00000000031F8000-0x0000000003200000-memory.dmp
memory/2400-520-0x00000000031A8000-0x00000000031B0000-memory.dmp
memory/2400-524-0x0000000003200000-0x0000000003208000-memory.dmp
memory/2400-523-0x00000000031B0000-0x00000000031B8000-memory.dmp
memory/2400-526-0x00000000031B8000-0x00000000031C0000-memory.dmp
memory/2400-527-0x0000000003208000-0x0000000003210000-memory.dmp
memory/2400-529-0x00000000031C0000-0x00000000031C8000-memory.dmp
memory/2400-530-0x0000000003210000-0x0000000003218000-memory.dmp
memory/2400-531-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-534-0x0000000003218000-0x0000000003220000-memory.dmp
memory/2400-533-0x00000000031C8000-0x00000000031D0000-memory.dmp
memory/2400-536-0x00000000031D0000-0x00000000031D8000-memory.dmp
memory/2400-444-0x0000000003150000-0x0000000003158000-memory.dmp
memory/2400-539-0x00000000031D8000-0x00000000031E0000-memory.dmp
memory/2400-540-0x0000000003228000-0x0000000003230000-memory.dmp
memory/2400-543-0x0000000003230000-0x0000000003238000-memory.dmp
memory/2400-542-0x00000000031E0000-0x00000000031E8000-memory.dmp
memory/2400-545-0x00000000031E8000-0x00000000031F0000-memory.dmp
memory/2400-546-0x0000000003238000-0x0000000003240000-memory.dmp
memory/2400-550-0x0000000003240000-0x0000000003248000-memory.dmp
memory/2400-549-0x00000000031F0000-0x00000000031F8000-memory.dmp
memory/2400-553-0x0000000003248000-0x0000000003250000-memory.dmp
memory/2400-552-0x00000000031F8000-0x0000000003200000-memory.dmp
memory/2400-557-0x0000000003250000-0x0000000003258000-memory.dmp
memory/2400-556-0x0000000003200000-0x0000000003208000-memory.dmp
memory/2400-432-0x00000000030F8000-0x0000000003100000-memory.dmp
memory/2400-430-0x0000000003160000-0x0000000003168000-memory.dmp
memory/2400-426-0x0000000003158000-0x0000000003160000-memory.dmp
memory/2400-423-0x0000000003148000-0x0000000003150000-memory.dmp
memory/2400-422-0x0000000003100000-0x0000000003108000-memory.dmp
memory/2400-414-0x00000000030D8000-0x00000000030E0000-memory.dmp
memory/2400-416-0x00000000030E0000-0x00000000030E8000-memory.dmp
memory/2400-415-0x0000000003150000-0x0000000003158000-memory.dmp
memory/2400-569-0x0000000003208000-0x0000000003210000-memory.dmp
memory/2400-570-0x0000000003258000-0x0000000003260000-memory.dmp
memory/2400-573-0x0000000003260000-0x0000000003268000-memory.dmp
memory/2400-572-0x0000000003210000-0x0000000003218000-memory.dmp
memory/2400-592-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-596-0x0000000003218000-0x0000000003220000-memory.dmp
memory/2400-597-0x0000000003268000-0x0000000003270000-memory.dmp
memory/2400-600-0x0000000003220000-0x0000000003228000-memory.dmp
memory/2400-601-0x0000000003270000-0x0000000003278000-memory.dmp
memory/2400-603-0x0000000003278000-0x0000000003280000-memory.dmp
memory/2400-602-0x0000000003228000-0x0000000003230000-memory.dmp
memory/2400-606-0x0000000003280000-0x0000000003288000-memory.dmp
memory/2400-605-0x0000000003230000-0x0000000003238000-memory.dmp
memory/2400-610-0x0000000003288000-0x0000000003290000-memory.dmp
memory/2400-609-0x0000000003238000-0x0000000003240000-memory.dmp
memory/2400-612-0x0000000003290000-0x0000000003298000-memory.dmp
memory/2400-611-0x0000000003240000-0x0000000003248000-memory.dmp
memory/2400-615-0x0000000003298000-0x00000000032A0000-memory.dmp
memory/2400-614-0x0000000003248000-0x0000000003250000-memory.dmp
memory/2400-621-0x0000000003258000-0x0000000003260000-memory.dmp
memory/2400-618-0x0000000003250000-0x0000000003258000-memory.dmp
memory/2400-620-0x00000000032A8000-0x00000000032B0000-memory.dmp
memory/2400-619-0x00000000032A0000-0x00000000032A8000-memory.dmp
memory/2400-624-0x00000000032B0000-0x00000000032B8000-memory.dmp
memory/2400-623-0x0000000003260000-0x0000000003268000-memory.dmp
memory/2400-398-0x00000000030F0000-0x00000000030F8000-memory.dmp
memory/2400-391-0x00000000030A0000-0x00000000030C8000-memory.dmp
memory/2400-631-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-634-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2400-651-0x0000000003268000-0x0000000003270000-memory.dmp
memory/2400-652-0x00000000030C8000-0x00000000030D0000-memory.dmp