e8a846c838834c210aee1c90edf061312ae6ad3c9027e44fe5428bbc0398da06

General

Target
2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe
Size 76KB
Sample260724-k6ak2awsdv
SHA256 e8a846c838834c210aee1c90edf061312ae6ad3c9027e44fe5428bbc0398da06
MD5 8827ef4d163980b80db0a1d67b065a4d
SHA1 ed7317196cabd0ecf13244f7d9714a6666d6552b
SHA512 3b82927b4c9972689489e3990409feecee3c2f2edaaa7412c27ae125479563cc49671e87af82120930f035a496004d1d90de73e64123c4634861e4861d0cd846
SSDEEP 768:vvw9816vhKQLrof/4/QQP5EQcpFnbMgDa1GQTTyS1tl7lfqvocqcd/V9:nEGh0of/Fa5EQcpGgDa1rnyS1loL/L
TLSH
T1CE736C03A584B5F2EBAC0135B19F0FBE563B86B1C4C9282F5B638DB55862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x00050000000006d3-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000900000001daff-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x001200000001da6d-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000500000001e0fe-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 4 IoCs

pid	Process
6040	kA242D43E9688Eo4646k8E433DF06076158DAu.exe
1788	k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe
5360	k7334E40C9687Co43efk8AC73206B0953F16Du.exe
5912	kB81357189A810o47a4k9E1430CC25347FF5Du.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\kB81357189A810o47a4k9E1430CC25347FF5Du.exe	k7334E40C9687Co43efk8AC73206B0953F16Du.exe
File created	C:\Windows\kA242D43E9688Eo4646k8E433DF06076158DAu.exe	2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe
File created	C:\Windows\k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe	kA242D43E9688Eo4646k8E433DF06076158DAu.exe
File created	C:\Windows\k7334E40C9687Co43efk8AC73206B0953F16Du.exe	k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe
816	cmd.exe
4060	cmd.exe
1792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k7334E40C9687Co43efk8AC73206B0953F16Du.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kA242D43E9688Eo4646k8E433DF06076158DAu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kB81357189A810o47a4k9E1430CC25347FF5Du.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4608	2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	6040	kA242D43E9688Eo4646k8E433DF06076158DAu.exe
Token: SeIncBasePriorityPrivilege	1788	k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe
Token: SeIncBasePriorityPrivilege	5360	k7334E40C9687Co43efk8AC73206B0953F16Du.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 6040	4608	2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe	88
PID 4608 wrote to memory of 1792	4608	2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe	89
PID 6040 wrote to memory of 1788	6040	kA242D43E9688Eo4646k8E433DF06076158DAu.exe	92
PID 6040 wrote to memory of 4572	6040	kA242D43E9688Eo4646k8E433DF06076158DAu.exe	93
PID 1788 wrote to memory of 5360	1788	k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe	104
PID 1788 wrote to memory of 816	1788	k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe	105
PID 5360 wrote to memory of 5912	5360	k7334E40C9687Co43efk8AC73206B0953F16Du.exe	106
PID 5360 wrote to memory of 4060	5360	k7334E40C9687Co43efk8AC73206B0953F16Du.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_8827ef4d163980b80db0a1d67b065a4d_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\kA242D43E9688Eo4646k8E433DF06076158DAu.exe
  C:\Windows\kA242D43E9688Eo4646k8E433DF06076158DAu.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe
    C:\Windows\k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\k7334E40C9687Co43efk8AC73206B0953F16Du.exe
      C:\Windows\k7334E40C9687Co43efk8AC73206B0953F16Du.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5360
    - - C:\Windows\kB81357189A810o47a4k9E1430CC25347FF5Du.exe
        
        C:\Windows\kB81357189A810o47a4k9E1430CC25347FF5Du.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\K7334E~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\K45EEF~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\KA242D~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe

Path C:\Windows\k45EEFF4D9C6F9o455ekB3CD3CF9B54333B9Fu.exe
Size 76KB
SHA256 605d62b49b7f22d29c2967f76ea561e51724da29c0d6357e0ee8ae0f1242b5e9
MD5 7a3565d026f8df293ca7b5061c054321
SHA1 415d1fa664e58b373ad5044ad1ce397e788e0bd6
SHA512 0553302e52675852e397ee1e325195895f8c8dddd43db92f68fc2068ddd661764dc7aa6f37d5802476c0736cdc2d2f151d1fea113b1475d8807669776480bc9a
SSDEEP 768:vvw9816vhKQLroN/4/QQP5EQcpFnbMgDa1GQTTyS1tl7lfqvocqcd/V9:nEGh0oN/Fa5EQcpGgDa1rnyS1loL/L
TLSH
T10D736C03A584B5F2EBAC0135B19F0FBE563B96B1C4C9282F5B638DB55862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k7334E40C9687Co43efk8AC73206B0953F16Du.exe

Path C:\Windows\k7334E40C9687Co43efk8AC73206B0953F16Du.exe
Size 76KB
SHA256 d73b21f78fac09fc8349bda8273039d28158dc2dfc6e5caa2d94b946f87e58c5
MD5 0f80a16c15b52cc95545deae2fd1fedd
SHA1 dbcca9781cdc272c25c227d3bbd0db3eae5fb991
SHA512 33d9f531280c23c47702407d57316d9083dd7fcf5955b9f305e15ef002919bcda7b7eab7d5d9ddbad9ba4d3cc743398230e56179b7201cf112443e39a26d5096
SSDEEP 768:vvw9816vhKQLroS/4/QQP5EQcpFnbMgDa1GQTTyS1tl7lfqvocqcd/V9:nEGh0oS/Fa5EQcpGgDa1rnyS1loL/L
TLSH
T140736C03A584B5F2EBAC0135B19F1FBE563B86B1C4C9282F5B634DB55862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kA242D43E9688Eo4646k8E433DF06076158DAu.exe

Path C:\Windows\kA242D43E9688Eo4646k8E433DF06076158DAu.exe
Size 76KB
SHA256 18ebb4930e220b761e5850b2a57ae26f8278937bf6fcdddef823f459e6a0b25e
MD5 5ab2a5a1a596e9e54679240a5453fe47
SHA1 c950a9e534abba59f589b94ddd40e3a31a2c9920
SHA512 f1c1e6f23ce7d409f7f4fd86498df0be49621ae9de46fea33eea28e04824266755cd7eb24e188e0e3ce98e9ee1b2c1a648fc2c49eaf75ab28c16fa31b2654a23
SSDEEP 768:vvw9816vhKQLroe/4/QQP5EQcpFnbMgDa1GQTTyS1tl7lfqvocqcd/V9:nEGh0oe/Fa5EQcpGgDa1rnyS1loL/L
TLSH
T138736B03A584B5F2EBAC0135B19F0FBE563B86B1C4C9282F5B638DB55862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kB81357189A810o47a4k9E1430CC25347FF5Du.exe

Path C:\Windows\kB81357189A810o47a4k9E1430CC25347FF5Du.exe
Size 76KB
SHA256 d5ea80a419bda7f8fcb0a044c5b26d8cbc82149480e7bb0bccdd52e36d5b2728
MD5 22a234760c72f402108ee8249d313d53
SHA1 8ecd7e56f93ee0f9ffb3521f2e375f48ba4128de
SHA512 9fd0a7862604405d4dbab7f35efce6ecf768837cf708c50b4dd594bacb43e653f81909d6c1152ef5d57b53dfee4fa9c35ecf32568e95eaa3cfbfef8bd708b9d4
SSDEEP 768:vvw9816vhKQLroq/4/QQP5EQcpFnbMgDa1GQTTyS1tl7lfqvocqcd/V9:nEGh0oq/Fa5EQcpGgDa1rnyS1loL/L
TLSH
T10B735B03A584B5F2EBAC0135B19F1FBE563B86B1C4C9282F5B638DB55862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads