f52dcf7ef8e8b26ce19135930f36ee59c4c472897982e5eedccbb00af2d1d765

General

Target
2026-07-22_6f4eede80c5bb9c296a3e34ce8fe6cb0_elex_wannacry.exe
Size 15.4MB
Sample260722-3srw9sdf93
SHA256 f52dcf7ef8e8b26ce19135930f36ee59c4c472897982e5eedccbb00af2d1d765
MD5 6f4eede80c5bb9c296a3e34ce8fe6cb0
SHA1 deacac6fe71ea6468c2bc7a95b70311caf74083e
SHA512 0fda5520c9c52383841799e98d78d6471503dd60fa4ea83f714d804e5dd1719aade738b39b75166d082136bb40bff2fe943a6cb61177258c68281be8e4a035f8
SSDEEP 393216:uPrOJ6ljsZW9QDNfR5CZ3J+bvIpYIm1Dshhih7gfIm:uiJ6uZW9kJIgDChiafL
TLSH
T17CF633EC56365B06DAB10C7BC5995C7E24EE70B94CE395EB6AF2D3C012026C3315A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\VerifierFlags = "2147483648"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\VerifierDlls = "KexDll.dll"	KexSetup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\GlobalFlag = "256"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\VerifierFlags = "2147483648"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\VerifierDlls = "KexDll.dll"	KexSetup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\GlobalFlag = "256"	KexSetup.exe

Executes dropped EXE 3 IoCs

pid	Process
4244	KexSetup.exe
5832	KexSetup.exe
1068	KexSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4328	5832	WerFault.exe	90
3276	1068	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KexSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KexSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KexSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_6f4eede80c5bb9c296a3e34ce8fe6cb0_elex_wannacry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5832	KexSetup.exe
Token: SeDebugPrivilege	1068	KexSetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4244	3492	2026-07-22_6f4eede80c5bb9c296a3e34ce8fe6cb0_elex_wannacry.exe	89
PID 4244 wrote to memory of 5832	4244	KexSetup.exe	90
PID 4244 wrote to memory of 1068	4244	KexSetup.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-22_6f4eede80c5bb9c296a3e34ce8fe6cb0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_6f4eede80c5bb9c296a3e34ce8fe6cb0_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe
  C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe" /SILENTUNATTEND /HWND:262296 /KEXDIR:"C:\Program Files\VxKex"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 540
      4⤵
      Program crash
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe" /SILENTUNATTEND /HWND:262296 /KEXDIR:"C:\Program Files\VxKex"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 516
      4⤵
      Program crash
      PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5832 -ip 5832
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1068 -ip 1068
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KexSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7z9358EDA4\KexSetup.exe
Size 173KB
SHA256 1190a00f2503e24fe3fdd6b9f5adf76c0d1fc79f5ce38523b0a538d6448d40ea
MD5 aaa46e60621d244efd4f41239a2b4d98
SHA1 c2316a7315758d6af2ddc99e1fde6a7ba6e07dd7
SHA512 f1ce61cf0bb9f071ac624973ffdd70efb3c70fc01e528593ff3e551a12363f666a227cbb4e16dcdcdfc2d1c3ffcf654c536d351bf3a6e09f1e5ea50ef0493dd0
SSDEEP 3072:MQP4t50WK6oEoXIEsIaXlufYGxdLIGQQMzajQKW6BXLzB7FksbE4CS08NEsFX:tgt5YVE+LsIssIGQQMbL6BXLzB7+6EqX
TLSH
T13304E821A7E80054F1F35A73AF355691A93ABD354B35E5CF53809A8E2072EC6AD31F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads