8f0cc394c864fe41ff1ad388dfc61e792100ece3e118091017a5517a77d24073

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_62eb496e012cc678ed006d7cf83e01c1_elex_wannacry.exe
Size 7.6MB
Sample260728-2vb36abl9w
SHA256 8f0cc394c864fe41ff1ad388dfc61e792100ece3e118091017a5517a77d24073
MD5 62eb496e012cc678ed006d7cf83e01c1
SHA1 55ca615c24ee089f40fb3d88782e335115141229
SHA512 1ddf65cf6555ff688ca6e1505643977d3dfa88d0a6052052c7c70c6f701a5e83e4ec05aeb5564af37307f4260d56eb366c3296135278dff3f78d562ae9ed878a
SSDEEP 196608:xpIcIIC9V84z8AlN9rkRRrsxDLA+jM7qoHiJruC2rGQqRMN:IL9HzlnrIIN1ZoHiQDGQqk
TLSH
T1AA863353F64004C6CB596972AF570BA423FFAE5E4669EDC273573CBA00243684F0B65E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2404	servbrow.exe
1700	servbrow.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\servbrow.exe	2026-07-28_62eb496e012cc678ed006d7cf83e01c1_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_62eb496e012cc678ed006d7cf83e01c1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	servbrow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	servbrow.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTcbPrivilege	2404	servbrow.exe
Token: SeChangeNotifyPrivilege	2404	servbrow.exe
Token: SeIncreaseQuotaPrivilege	2404	servbrow.exe
Token: SeAssignPrimaryTokenPrivilege	2404	servbrow.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4424	2026-07-28_62eb496e012cc678ed006d7cf83e01c1_elex_wannacry.exe
2404	servbrow.exe
1700	servbrow.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1700	2404	servbrow.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-28_62eb496e012cc678ed006d7cf83e01c1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_62eb496e012cc678ed006d7cf83e01c1_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4424

C:\Windows\servbrow.exe
"C:\Windows\servbrow.exe" /Service
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\servbrow.exe
  "C:\Windows\servbrow.exe" /Popup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

servbrow.exe

Path C:\Windows\servbrow.exe
Size 7.6MB
SHA256 a3f70aab2d44e4e070601bce180cffe5fe8eadbaacfd834e0a1c7a478a51c118
MD5 28ca06a6c078a36acccfe3b6a556d8cb
SHA1 8c5a96b1016e76ee22c6b68e57b8cd64f29bbdd4
SHA512 75f5d28a7a199f6c2dd02a6482d1eaa67c3a28d375e13a630095a3ad83e89585f88c38aa0de51df9b2385e39c608091a8a1fbda805261505f1e2fe5cd0524f5f
SSDEEP 196608:WY17Du/MJijQPOx1CB7jsCoyB+9Ucp3zAUEl:WYpyEJijI61u7jsCxB+9n+l
TLSH
T1C086335708F1C2FEC276AB3B0DB62EB6FCE1C4D19819900D9B349A886E5FB749D74111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download