47760f6ef3a2043423a2545fea2dccdbd307e3f7f3c9a8851ff416e09666555f

General

Target
2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe
Size 59KB
Sample260719-nfwmcscw21
SHA256 47760f6ef3a2043423a2545fea2dccdbd307e3f7f3c9a8851ff416e09666555f
MD5 e67935ebd37b67154556e444d15e37fb
SHA1 2f89a16df11ec0cca7fef9d2bccf9c2ac47c56be
SHA512 6fa270f10b489e4583fa110e8403f4273fd26238837dd607f9286c6bb3d1351894868c865e7302c486653c46508f43111fd674856f544edff6206ef66c24f56b
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroo4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroo4/QQ2fBOu
TLSH
T1B1434A431FDD5CF2FB910171087E8B7986BB59E4C25FBEDBAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 7 IoCs

resource	yara_rule
behavioral1/files/0x00080000000246cf-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000006d3-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00030000000168f4-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000a00000001d8a9-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000168f4-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000b00000001d8a9-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000b00000001da2c-27.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 7 IoCs

pid	Process
1860	mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
1696	mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
2812	m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
5808	mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
5012	m38B73E24mAD55r4a9fx9463z2527063752E89.exe
5528	m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe
2916	m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe	2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe
File created	C:\Windows\mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe	mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
File created	C:\Windows\m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe	mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
File created	C:\Windows\mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe	m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
File created	C:\Windows\m38B73E24mAD55r4a9fx9463z2527063752E89.exe	mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
File created	C:\Windows\m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe	m38B73E24mAD55r4a9fx9463z2527063752E89.exe
File created	C:\Windows\m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe	m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6052	cmd.exe
1040	cmd.exe
3872	cmd.exe
5320	cmd.exe
2668	cmd.exe
3416	cmd.exe
4016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m38B73E24mAD55r4a9fx9463z2527063752E89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4744	2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1860	mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
Token: SeIncBasePriorityPrivilege	1696	mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
Token: SeIncBasePriorityPrivilege	2812	m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
Token: SeIncBasePriorityPrivilege	5808	mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
Token: SeIncBasePriorityPrivilege	5012	m38B73E24mAD55r4a9fx9463z2527063752E89.exe
Token: SeIncBasePriorityPrivilege	5528	m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1860	4744	2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe	90
PID 4744 wrote to memory of 5320	4744	2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe	91
PID 1860 wrote to memory of 1696	1860	mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe	92
PID 1860 wrote to memory of 2668	1860	mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe	93
PID 1696 wrote to memory of 2812	1696	mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe	96
PID 1696 wrote to memory of 3416	1696	mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe	97
PID 2812 wrote to memory of 5808	2812	m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe	98
PID 2812 wrote to memory of 4016	2812	m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe	99
PID 5808 wrote to memory of 5012	5808	mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe	100
PID 5808 wrote to memory of 6052	5808	mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe	101
PID 5012 wrote to memory of 5528	5012	m38B73E24mAD55r4a9fx9463z2527063752E89.exe	102
PID 5012 wrote to memory of 1040	5012	m38B73E24mAD55r4a9fx9463z2527063752E89.exe	103
PID 5528 wrote to memory of 2916	5528	m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe	107
PID 5528 wrote to memory of 3872	5528	m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_e67935ebd37b67154556e444d15e37fb_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
  C:\Windows\mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
    C:\Windows\mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
      C:\Windows\m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
        
        C:\Windows\mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5808
      - C:\Windows\m38B73E24mAD55r4a9fx9463z2527063752E89.exe
        
        C:\Windows\m38B73E24mAD55r4a9fx9463z2527063752E89.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe
        
        C:\Windows\m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\Windows\m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe
        
        C:\Windows\m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\M3687C~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\M38B73~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1040
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\MFEEBB~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6052
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\M8206B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\MA2C87~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\ME4386~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe

Path C:\Windows\m0A9032E3mC5BEr41faxA99Az13FD561BEC509.exe
Size 59KB
SHA256 8da3a122f055d9c89aab7f1d65efb899dc65f60b3c7e53ab8cb2d2f9b7c2d483
MD5 71e667c7c78a8e0015ecb164f9a9297f
SHA1 6f1125777bbc1524d8d410f99bcf1f8860d6fb35
SHA512 d7756daa6287660e7ae5306459e59dcea848412a4f1d68c9f477f7abbdcfd9e074836272c2afc2d2a18a813f93b717a7dde2ac33778762f5a98046b000428fb7
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrop4/Clsrnu5WcnfBYRu:Mvw9816vhKQLrop4/QQ2fBOu
TLSH
T1ED434A430FDD5CF2FB810171087E8B7987BB49E4C25FBE8BAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe

Path C:\Windows\m3687C6CEm7AFEr428ex9D00zD7D68EFE4F9A9.exe
Size 59KB
SHA256 ad2cdd0991ab7fc1db2793e1423e220716b4c6a0364cfa4aae53db6b1024ce80
MD5 233f9550c542c8f2c0dbeb05723a89de
SHA1 b8bad6c4a4995806c72e741680f66b568bf92c14
SHA512 97d37fc77b5ef7e266e85abd90c292b0e8a036ea85bc9a8408a64de8ed05668608e0e35f3a4a5505996a617b097e56ba656dd4ea3e002ed99ce642666195c2ce
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLro14/Clsrnu5WcnfBYRu:Mvw9816vhKQLro14/QQ2fBOu
TLSH
T165434A430FDD5CF2FB910175087E8B7986BB49E4C25FBE8BAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m38B73E24mAD55r4a9fx9463z2527063752E89.exe

Path C:\Windows\m38B73E24mAD55r4a9fx9463z2527063752E89.exe
Size 59KB
SHA256 74cfd1f1748fe6cea25cc2949b97f74ba897c47d0c0c5bf7239628cacfe76308
MD5 73252e6002141ab04f78cfddf60cc1c4
SHA1 4d7b2138302eb24d1fbc2f97823f58266d8f087b
SHA512 3310569ba4a7ceb2a588f98e171d3ab3c8246d9fdac2e5c2af8d8dc534bb6a853a8be91a46f2c79f198f6e072a4cba45736458b4465b4e4a54cbf8c8334601d6
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroZ4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroZ4/QQ2fBOu
TLSH
T10F433A430FDD5CF2FB910175087E8B7986BB59E4C25FBE8BAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe

Path C:\Windows\m8206BEA0mF7F6r419exA9CCz14601DD277F49.exe
Size 59KB
SHA256 495598ae153cec8b090d55e257bb6ef4f3089e44d969731dbf93928329caf396
MD5 fe27666252a9d385ab7285171edf4385
SHA1 be0e51c0d7150d95ffc4c8b96594edc057c9cae5
SHA512 9a0da8de1eb5f4bca2fb56574a1abb4a638fb2ecf6c1ea03cb2c2d8328ce0ba6be76728939856cec5b4161d8d53ce599679d17743bf695d1f0fbd80dd721d1e5
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroy4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroy4/QQ2fBOu
TLSH
T1A3433A431FDD5CF2FB910175087E8B7986BB59D4C25FBE8BAF50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe

Path C:\Windows\mA2C87117m4E56r4869xBE04zAFB65E65141C9.exe
Size 59KB
SHA256 0382b30825c3db09b8ad3832b3225350b52ac24c66806e4ed11fae67df1a8a31
MD5 c0ac718921a67f722207993d69d3261b
SHA1 084012ccf03261e9eb3136e5def5df475d67e0b6
SHA512 931ee35877e10dfb43ad223ebd6a73c826c38ab1b52804bb1dc5ab62da73d8e54674656e489b295f892ce1701843fb18c0e3a1577988ecd8d8375a1c11856f22
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroTH4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroTH4/QQ2fBOu
TLSH
T1A64339431FDD5CF2FB810175087E8B7987BB59E4C25FBE8BAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe

Path C:\Windows\mE43866D8m538Ar4349xA3C7z398BB69B33F39.exe
Size 59KB
SHA256 db97d90f69e788d2770358dc1106083deb5419d97c165b632aeeb02e79267a58
MD5 1a73548817b74378f6b523ed161b4e13
SHA1 eaa3872dbbf135c1f92c453a7dacf79226519686
SHA512 999f235ba02d7245e2881ab477606f10f561131c0a9f46f4b9a0f7e2dfe30e31729e365d8c68eea49bdc8e80fcc9e8b4fc024ed65e70e6c360bbd082c7b07fd6
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroXb4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroXb4/QQ2fBOu
TLSH
T1E7434A431FDD5CF2FB810175087E8B7986BB59E4C25FFE8BAB50CC584836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe

Path C:\Windows\mFEEBB070m1CDDr46a3x855CzE9EFC0244A409.exe
Size 59KB
SHA256 3039f6f5c5bc9d4c17b61ee1e9b69f74ea0cff87cbec2717ce0ee204402c6c78
MD5 d93deb12333f26c5d5c5dde51a94750b
SHA1 9dbd70ea88bab428d623bb9cd9076a232b029c4f
SHA512 9e463b47f593ec13c281da0c718f2edb6636694e3384360948a3c76d8f92e97eb7dc96484f91f6eb587bd5cc267ee051f2dbe11940b446ec001153815d52fa6d
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLro34/Clsrnu5WcnfBYRu:Mvw9816vhKQLro34/QQ2fBOu
TLSH
T178434A430FDD5CF2FB810171087E8B7986BB49E4C25FBE8BAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads