Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/07/2026, 18:46

General

  • Target
    2026-07-17_8f313c7dc9fccab545be108455599e5a_elex_mimic_pay2key_wannacry.exe
  • Size 16.3MB
  • Sample260717-xerrfse19v
  • SHA256 f698975b35e7170896760721d4b2a856354c47fc4859b2720beb52ee5a094915
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detects executables packed with ASPack 9 IoCs
  • UPX dump on OEP (original entry point) 7 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_8f313c7dc9fccab545be108455599e5a_elex_mimic_pay2key_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_8f313c7dc9fccab545be108455599e5a_elex_mimic_pay2key_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Program Files (x86)\Mbox\软件安装.exe
      "C:\Program Files (x86)\Mbox\软件安装.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Users\Admin\AppData\Local\Temp\ScUpWork.exe
        C:\Users\Admin\AppData\Local\Temp\ScUpWork.exe "C:\Program Files (x86)\Mbox\" "软件安装.exe" "C:\Windows\Temp\~MboxLog\ScUpdatemd5.ini" "http://mbox.sysceo.cn/Update/mboxup.txt" "NIL"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4816
  • C:\Program Files (x86)\Mbox\Res\MboxSer.exe
    "C:\Program Files (x86)\Mbox\Res\MboxSer.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2616

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Btn_Close.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_Close.png
        • Size 3KB
        • SHA256 da5e625ff0f363abc6e13ea5d8af32af860cb99beba5311bc478e92373493289
        • MD5 SHA1 SHA512 TLSH

        Btn_Mini.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_Mini.png
        • Size 2KB
        • SHA256 ca744086a226aeacc716c153867cbfc70f27c2dc0cba5ded9aefbf8d43acdf50
        • MD5 SHA1 SHA512 TLSH

        Btn_OneKey.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_OneKey.png
        • Size 3KB
        • SHA256 d6252ae7c7b241fd6e55dfda72bf4b40414dfc3b866827a6f7b6fff2410e4e9c
        • MD5 SHA1 SHA512 TLSH

        Btn_Refresh.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_Refresh.png
        • Size 1KB
        • SHA256 744d8b485890bee646954ced49d06d62cce7df9fd8f4d2412bf32ece63255f10
        • MD5 SHA1 SHA512 TLSH

        Btn_Set.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_Set.png
        • Size 2KB
        • SHA256 cd0547e32286e340bc65cfcd2c550884973fc952fffee10885d42e65e413225d
        • MD5 SHA1 SHA512 TLSH

        Btn_Small.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_Small.png
        • Size 17KB
        • SHA256 609f56c9700623942124cddb598480210a5a1c368208afaf852386324a9d18a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Btn_search1.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_search1.png
        • Size 1KB
        • SHA256 2d010dba9e8949efc55e04de6468436e7993dcf13aecf460df11ebb262014ed2
        • MD5 SHA1 SHA512 TLSH

        Btn_search2.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_search2.png
        • Size 1KB
        • SHA256 d75257fc480512a711eb271a799c7cbab338e733fdd489c62aa74c8e2ca0a8db
        • MD5 SHA1 SHA512 TLSH

        Btn_search3.png

        • Path C:\Program Files (x86)\Mbox\Res\Btn_search3.png
        • Size 1KB
        • SHA256 47a457904837d3956e14a5ee91be4bba08ffa788ddae7cfb92742f7a8728cef2
        • MD5 SHA1 SHA512 TLSH

        Softlist.smb

        • Path C:\Program Files (x86)\Mbox\Res\Data\Softlist.smb
        • Size 5KB
        • SHA256 4a48199de149ab2284b1dc00fc4b62372363c98f9dc9294515fd47b30d0c0190
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Download.png

        • Path C:\Program Files (x86)\Mbox\Res\Download.png
        • Size 1KB
        • SHA256 0aa69253268f6e9f4e1e5775d695e32269662c6bbe41a384c4070634fd26b50c
        • MD5 SHA1 SHA512 TLSH

        19176acc8ceb6585173baaa667d9ecd9.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\19176acc8ceb6585173baaa667d9ecd9.png
        • Size 3KB
        • SHA256 45e29f3a16360234930145637c41245cea06bff2911d8c0bb2a2c14a379c3de9
        • MD5 SHA1 SHA512 TLSH

        2345Explorer_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\2345Explorer_00001.png
        • Size 2KB
        • SHA256 b868be5913021d2c35c275c6666e62b8d6e47184df15742b2be18b2fa132e4bd
        • MD5 SHA1 SHA512 TLSH

        265e04bfa2dec4629d1c4f513c0f29bc.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\265e04bfa2dec4629d1c4f513c0f29bc.png
        • Size 5KB
        • SHA256 ab67e538db08015d03d4ccbc7ca4a5c9f003935fa1bc2252d7c828d497ec7671
        • MD5 SHA1 SHA512 SSDEEP TLSH

        295fb5e70b7b351409d9f2e6ddc1d32f.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\295fb5e70b7b351409d9f2e6ddc1d32f.png
        • Size 4KB
        • SHA256 af9e4fa61f1fa824c29489cd6a79862d02191f53424233d916c5a3a17a628d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360Safe_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\360Safe_00001.png
        • Size 5KB
        • SHA256 7eb812489c6bab0cfe26bf341cf3f6ede954f17422aaf88a02d921c1c0a646f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360sd_48914_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\360sd_48914_00001.png
        • Size 4KB
        • SHA256 6537370b3f96dfa05793a5b085880c8c57ad191b23bc87819a9c2c12b9284b2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360se_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\360se_00001.png
        • Size 4KB
        • SHA256 3603d22809c69bf10045e041d604432a5f6306e715c632c4717fe523a7ae51aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        3c8dd4adc011e0ab0d0c803bc76c300a.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\3c8dd4adc011e0ab0d0c803bc76c300a.png
        • Size 6KB
        • SHA256 38e286aa9ae181d74b035ba1241dd76ccd68d8fb8c5fb3d86bd35a2073cae6b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        75ac5beca81b18a3c0a33001df133e01.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\75ac5beca81b18a3c0a33001df133e01.png
        • Size 3KB
        • SHA256 6ca1ffcb06fe54a4392fca941b50861ffc195aa1a32548352252e5522b80e289
        • MD5 SHA1 SHA512 TLSH

        Lenovo.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\Lenovo.png
        • Size 12KB
        • SHA256 e7b10140eb67693fa85b5a2b572b825e9c1ed960f7add8d6705a5d3a243fe3e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft Office 2016 X64 20170323_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\Microsoft Office 2016 X64 20170323_00001.png
        • Size 552B
        • SHA256 7c138c81c10d19c3708b811d99d2a89bce4fd289d3b7ea2867111a5ee0d72be2
        • MD5 SHA1 SHA512 TLSH

        Office2003_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\Office2003_00001.png
        • Size 3KB
        • SHA256 ed72fa637e3703e0c29161a654d1a9c87949f4246e40755c758d54848f6e47db
        • MD5 SHA1 SHA512 TLSH

        Office2007_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\Office2007_00001.png
        • Size 4KB
        • SHA256 d307e02ae9e71169317d3336cd4a655d424d92c284d0232c8da6679e18d61957
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QQPCDownload1316_00001.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\QQPCDownload1316_00001.png
        • Size 1KB
        • SHA256 3c262b7cff6615011b57d895a7d4b55741b4163694547bcde86151ddded8de70
        • MD5 SHA1 SHA512 TLSH

        a4bde97cc7126a12608834e42c92fdb0.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\a4bde97cc7126a12608834e42c92fdb0.png
        • Size 3KB
        • SHA256 33f4e7858592894ebc0f7cbf101cec75bc32520028ab3deda0ddf36bc57a41c6
        • MD5 SHA1 SHA512 TLSH

        c85e727cbcdbec86216aa4546c6cd354.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\c85e727cbcdbec86216aa4546c6cd354.png
        • Size 7KB
        • SHA256 1ecf8c715dbc0a3a99253d25985b887f028369590f3e2745df097da18fc08df4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        f5a4409e6b069027545f249580ad2cd2.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\f5a4409e6b069027545f249580ad2cd2.png
        • Size 4KB
        • SHA256 0c2cb19ada050da816a1ad5007351b253b23994dd0f60698f3538a306693e217
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktw.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\ktw.png
        • Size 4KB
        • SHA256 d821edb188ce586c511505347c15d8ecc01aaaa5c4eca361171ac3f04ffc26ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pinyin.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\pinyin.png
        • Size 3KB
        • SHA256 c456a1f3510a6c272d48364bfd35a7cfacff03f29f368bd3d4b92f897c37de53
        • MD5 SHA1 SHA512 TLSH

        steambox_online_3.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\steambox_online_3.png
        • Size 5KB
        • SHA256 1bf97d019da4eb8efe05f678b12d8a76fb912b79722a50fc4a81ee233eefb0cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wps.png

        • Path C:\Program Files (x86)\Mbox\Res\Icon\wps.png
        • Size 5KB
        • SHA256 edce94498df5dca7b7ab5d67b6c0cc38c66b49f0ab859190e26d960d750144b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Line.png

        • Path C:\Program Files (x86)\Mbox\Res\Line.png
        • Size 3KB
        • SHA256 92d2ced0491c66ff11e5a83f762510d8746a752fd29856c09e7e30f087b50c12
        • MD5 SHA1 SHA512 TLSH

        Logo.png

        • Path C:\Program Files (x86)\Mbox\Res\Logo.png
        • Size 10KB
        • SHA256 47a13217121a1e14a032a194004a01a4dccd6d3bdb96b328ee465a76c4aef500
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Logo_un.png

        • Path C:\Program Files (x86)\Mbox\Res\Logo_un.png
        • Size 12KB
        • SHA256 c726560ec6c29b4d0fd4917037e3db5323d56e930160d1201e406a34033afb97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MboxSer.exe

        • Path C:\Program Files (x86)\Mbox\Res\MboxSer.exe
        • Size 805KB
        • SHA256 04660b31760b902846d2e3e036e4e9134d9d9a561760233a8a3f2f73fc12ba55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Msgbox_Bigok.png

        • Path C:\Program Files (x86)\Mbox\Res\Msgbox_Bigok.png
        • Size 3KB
        • SHA256 27f06324abacaf38d6ed9a72af3b2edb86b68e65772cfd8bd45f02cecf6e46ba
        • MD5 SHA1 SHA512 TLSH

        Msgbox_Exit.png

        • Path C:\Program Files (x86)\Mbox\Res\Msgbox_Exit.png
        • Size 2KB
        • SHA256 afdd41871966b0cf6d0f4a10ebdfc43a9e9f9330cb4a0869c87a36735f92858e
        • MD5 SHA1 SHA512 TLSH

        Msgbox_Ok.png

        • Path C:\Program Files (x86)\Mbox\Res\Msgbox_Ok.png
        • Size 2KB
        • SHA256 5ff396d37f04d10b608c403c024d5d1f3ffd2d6310256cee062f73f49a75a6cd
        • MD5 SHA1 SHA512 TLSH

        Nosoft.png

        • Path C:\Program Files (x86)\Mbox\Res\Nosoft.png
        • Size 4KB
        • SHA256 430972d8b763dd010110c5f374fd118e663a2d7481cb037a059cad26d3f50854
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Read_Load.gif

        • Path C:\Program Files (x86)\Mbox\Res\Read_Load.gif
        • Size 17KB
        • SHA256 3b73f87c5ceec5c1bf1e63b460b5fa8a08b4c586fd21a94ef4d8d6122ed027e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SFolder.png

        • Path C:\Program Files (x86)\Mbox\Res\SFolder.png
        • Size 20KB
        • SHA256 6aa938f98e0b95cf7764c7d3bc332e9db2d8ea9bd665b7cadb6c889b2d6a91f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Sof_All.png

        • Path C:\Program Files (x86)\Mbox\Res\Sof_All.png
        • Size 10KB
        • SHA256 9838373ce2d8a1271fce592175ad31ee9598bfe9e71353f74301a9e5eddb256e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Chat.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Chat.png
        • Size 11KB
        • SHA256 902197a6d29859a6214dd8a7a5485864f1a12cb0e38cdf8fbfc22ab602b17cea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Drvs.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Drvs.png
        • Size 13KB
        • SHA256 ed29f3a8dddf5e41ea78f94c6db641d695c369f0542721ee5610e1a88cfbaeaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Game.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Game.png
        • Size 12KB
        • SHA256 3dd0f61ba1dcda0303465d5eff534ceb85181c8758c933ae3f38a78872ddd27e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Net.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Net.png
        • Size 10KB
        • SHA256 7394db509f3e6bd4e04900723b90d8550b67eb33c15177ed91681383d0beb8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Office.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Office.png
        • Size 10KB
        • SHA256 89be6ea75fe90cda7c9b5734929e5db883045867a77dca505b4f195488b68149
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Pic.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Pic.png
        • Size 12KB
        • SHA256 cc85673250ccb29a0ff6bc246fe823f305886b2bc4848c63089d6673750a0a02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Safe.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Safe.png
        • Size 11KB
        • SHA256 22fb8b2b48ad65f25f1883d05d05de82614cf0c10df715c0d06905d82ad4e2c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_Sys.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_Sys.png
        • Size 11KB
        • SHA256 f3e4bb685f952023e3dbc8628d778fec2bda3fb759a2954ab9a95ea1652921c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Soft_hot.png

        • Path C:\Program Files (x86)\Mbox\Res\Soft_hot.png
        • Size 10KB
        • SHA256 3c16bd6f3b1e03c5798279ce8998b2f2eb98cd36bc12c0f6620da3ae45477230
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ThunderCmd.exe

        • Path C:\Program Files (x86)\Mbox\Res\Xunlei\download\ThunderCmd.exe
        • Size 3.1MB
        • SHA256 418ec1a3d9e343e5b7ce7aee520e7d609f39a1bd8ba38ff70de58bce08a7465d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        banner_un1.png

        • Path C:\Program Files (x86)\Mbox\Res\banner_un1.png
        • Size 10KB
        • SHA256 23b6ebb50adea866ee0a3d662b02c5b93809ff26085714a078d1f851abe9f1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        banner_un2.png

        • Path C:\Program Files (x86)\Mbox\Res\banner_un2.png
        • Size 10KB
        • SHA256 04689fa1296634bd47154d578eceae70475f1621d27185389fb3796da5e2d118
        • MD5 SHA1 SHA512 SSDEEP TLSH

        banner_un3.png

        • Path C:\Program Files (x86)\Mbox\Res\banner_un3.png
        • Size 10KB
        • SHA256 6a61971813f0623c58707db688c9d56d6c03037d4b951a542caa37cf87c98da0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        boxbg.png

        • Path C:\Program Files (x86)\Mbox\Res\boxbg.png
        • Size 1.6MB
        • SHA256 166838348ef606f6c6aad13f070546ac4ef49f4269a7255e5cfa89e9eab4eec2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id_load.gif

        • Path C:\Program Files (x86)\Mbox\Res\id_load.gif
        • Size 3KB
        • SHA256 ee0e0fe544b1cdfb01df2c15257935a78a2827fab8ada5146c4e9c2a7f7343e0
        • MD5 SHA1 SHA512 TLSH

        serror.png

        • Path C:\Program Files (x86)\Mbox\Res\serror.png
        • Size 436B
        • SHA256 2e34effd8bb007d45f62744d7575b362f5299fd68e8ec24b161386271920aaa2
        • MD5 SHA1 SHA512 TLSH

        sok.png

        • Path C:\Program Files (x86)\Mbox\Res\sok.png
        • Size 557B
        • SHA256 a6bbc4eca3dceb3c3534336bbf0f9d731546bb1d0db1b7298c241c6dd41ec30d
        • MD5 SHA1 SHA512 TLSH

        ver.png

        • Path C:\Program Files (x86)\Mbox\Res\ver.png
        • Size 3KB
        • SHA256 fdd7cf7b5fec67764381a2df1fea36c3e40296e881071b52f5a3c8282cbae40e
        • MD5 SHA1 SHA512 TLSH

        软件安装.exe

        • Path C:\Program Files (x86)\Mbox\软件安装.exe
        • Size 1.8MB
        • SHA256 5ac45d0c0fa3ca1a23c46a4f64bce887b8c39500e04a81aa973c218a2f827604
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2144-362-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-359-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-365-0x0000000000C20000-0x0000000000C21000-memory.dmp

        memory/2144-360-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-361-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-466-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-413-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-412-0x0000000000C20000-0x0000000000C21000-memory.dmp

        memory/2144-364-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2144-363-0x0000000000400000-0x0000000000A5F000-memory.dmp

        memory/2616-404-0x0000000000745000-0x0000000000746000-memory.dmp

        memory/2616-407-0x0000000000400000-0x0000000000746000-memory.dmp

        memory/2616-405-0x0000000000400000-0x0000000000746000-memory.dmp

        memory/2616-403-0x0000000000400000-0x0000000000746000-memory.dmp

        memory/4816-458-0x0000000000400000-0x0000000000E04000-memory.dmp

        memory/4816-465-0x0000000000400000-0x0000000000E04000-memory.dmp