e333150bd8cad2ff620d42290911971b684745f92bbfe0053bb7b709fdc4df72

Analysis

max time kernel
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
Size 629KB
Sample260730-vdsagssemg
SHA256 e333150bd8cad2ff620d42290911971b684745f92bbfe0053bb7b709fdc4df72
MD5 dcb717d79c60ba6c9537495472abc09a
SHA1 1713da70385ca2850c5b0f66463c359ec19f21c3
SHA512 c942a16fa9551cbceaaffdcb5b4bf9af3b292cba40e659d603eb852dd69b1e50418025e59cf264e2756b7fbf8c2e2367bb01cd490cbcf12db4b6b9654fe57b90
SSDEEP 6144:04sZBOZdjEYTPXMhaMP/kFTA7OA0BOZdjEYF:0nANL8oq/kFTsOcNF
TLSH
T1E4D41D3406718E04D463C3B42C950D955D6A1EF8CDF86796C707A0AE29BD7FA32AD3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ujdrdzad.exe

Deletes itself 1 IoCs

pid	Process
1876	ujdrdzad.exe

Executes dropped EXE 6 IoCs

pid	Process
1876	ujdrdzad.exe
2384	zdzjzs.exe
5784	cexfv.exe
3356	ujdrdzad.exe
4904	cexfv.exe
4160	zdzjzs.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\ujdrdzad = "c:\\windows\\system\\ujdrdzad.exe"	ujdrdzad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\zdzjzs = "c:\\windows\\system32\\zdzjzs.exe"	ujdrdzad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\cexfv = "c:\\windows\\cexfv.exe"	ujdrdzad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\ujdrdzad = "c:\\windows\\system\\ujdrdzad.exe"	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\zdzjzs = "c:\\windows\\system32\\zdzjzs.exe"	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\cexfv = "c:\\windows\\cexfv.exe"	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe

Drops file in System32 directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\oltujz.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\rnztzx.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\afzpa.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\rzhmxwko.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\lfuaxfjy.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\kmsamtrx.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\rzhmxwko.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\hqugczg.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\osoiich.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	\??\c:\windows\SysWOW64\zdzjzs.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\utkuv.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\kmsamtrx.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\rirq.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\ueflri.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\rirq.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\axxzjm.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\osoiich.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\axxzjm.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\ueflri.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\afzpa.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\hgeprq.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\utkuv.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\hgeprq.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\lfuaxfjy.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\yjvc.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\hqugczg.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\yjvc.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\rirq.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\hgeprq.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\osoiich.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\rnztzx.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\lfuaxfjy.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\kmsamtrx.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\utkuv.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\rnztzx.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\rzhmxwko.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\ueflri.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\afzpa.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\hqugczg.exe	ujdrdzad.exe
File opened for modification	C:\Windows\SysWOW64\oltujz.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\yjvc.exe	cexfv.exe
File opened for modification	C:\Windows\SysWOW64\oltujz.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\axxzjm.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File created	\??\c:\windows\SysWOW64\zdzjzs.exe	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\ytcatmhkjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\mvtevjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\mykzsjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\grtevjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\.axoukzjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\fqvncjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\cq.sbfjczc	cexfv.exe
File opened for modification	C:\Windows\system\qtorqxwjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\fcksf.jczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\nhakjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\twnfoujczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\c.fojczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\nekvixfejczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\afnigcnjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\umdqzwhnjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\.zufbutjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\panfa.jczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\drfczdfjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\mkqydmhajczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\lb.ujczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\egekohrnjczc	ujdrdzad.exe
File opened for modification	C:\Windows\gczkyvvyjczc	cexfv.exe
File opened for modification	C:\Windows\system\xdnrjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\xvmvjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\sutoohjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\dxozugijczc	ujdrdzad.exe
File opened for modification	C:\Windows\qhderyvjczc	cexfv.exe
File opened for modification	C:\Windows\system\pydpjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\biopjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\udbvwjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\biagrdqjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\hyfcjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\.zppnyjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\.fdizdpjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\fiuajczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\qvbsjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\rtcvjczc	ujdrdzad.exe
File opened for modification	C:\Windows\pzyismjczc	cexfv.exe
File opened for modification	C:\Windows\system\oqxrjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\hlpmwjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\ufneajczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\fycfhrlfjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\qkqlojczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\agaaaoyejczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\rzddjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\spdgpnpejczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\slnvjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\cqgnmwmyjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\byntpzjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\mchu.hfyjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\emfsjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\x.rxjczc	ujdrdzad.exe
File opened for modification	C:\Windows\xymclhjczc	cexfv.exe
File opened for modification	C:\Windows\system\z.hloqjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\ugqebqojczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\hwtfszlejczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\lieuvejczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\gvqfrljczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\ukevvujczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\esfaifjczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\wrbajczc	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
File opened for modification	C:\Windows\system\xpxcmyjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\qp.dbjczc	ujdrdzad.exe
File opened for modification	C:\Windows\system\qfnmbjczc	ujdrdzad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zdzjzs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujdrdzad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zdzjzs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cexfv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujdrdzad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cexfv.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
2384	zdzjzs.exe
2384	zdzjzs.exe
5784	cexfv.exe
5784	cexfv.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe
1876	ujdrdzad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1876	4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe	89
PID 4276 wrote to memory of 2384	4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe	90
PID 4276 wrote to memory of 5784	4276	2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe	91
PID 1876 wrote to memory of 4160	1876	ujdrdzad.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276
- C:\windows\system\ujdrdzad.exe
  "C:\windows\system\ujdrdzad.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe"
  2⤵
  - Drops file in Drivers directory
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4160
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2020
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:124
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4240
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:6124
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4464
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2460
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2080
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3272
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3440
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2820
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2912
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3400
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2120
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5156
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4540
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2428
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5048
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3860
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5116
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5440
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4688
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2676
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3640
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5604
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5676
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4660
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2188
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2468
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2096
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:260
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2552
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5280
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:6020
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4464
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2460
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2828
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4708
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5720
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4536
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3104
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3472
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2564
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1416
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1268
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2332
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3384
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1104
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5900
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4844
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5172
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:6036
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1232
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5708
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4568
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4592
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1676
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1168
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2936
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1268
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4472
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:832
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3648
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3764
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2840
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3084
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1640
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5668
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5100
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2584
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3988
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3372
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:6052
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2760
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2832
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1904
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2548
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:4504
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5384
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:6076
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:6064
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:480
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5708
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5560
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2376
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1676
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1304
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3096
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:3456
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1900
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:1112
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:2120
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5812
- - C:\windows\SysWOW64\zdzjzs.exe
    "C:\windows\system32\zdzjzs.exe"
    3⤵
    PID:5796
- C:\windows\cexfv.exe
  "C:\windows\cexfv.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5784

\??\c:\windows\system\ujdrdzad.exe
c:\windows\system\ujdrdzad.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356

\??\c:\windows\cexfv.exe
c:\windows\cexfv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4904
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3452
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3968
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2552
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5516
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:1584
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5376
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2440
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:1176
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3920
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5720
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:620
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3136
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:1112
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2004
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2948
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:1220
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2992
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:4712
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3816
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:4328
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5372
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:1080
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5828
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2252
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3000
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:4000
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5216
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:6080
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3832
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5160
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:240
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3504
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:4200
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5964
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5376
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2440
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2608
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3920
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2960
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2820
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:200
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:4292
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2672
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3400
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:2644
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:3328
- C:\windows\SysWOW64\zdzjzs.exe
  "C:\windows\system32\zdzjzs.exe"
  2⤵
  PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exezdzjzs.exe_

Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_dcb717d79c60ba6c9537495472abc09a_elex_wannacry.exezdzjzs.exe_
Size 629KB
SHA256 e333150bd8cad2ff620d42290911971b684745f92bbfe0053bb7b709fdc4df72
MD5 dcb717d79c60ba6c9537495472abc09a
SHA1 1713da70385ca2850c5b0f66463c359ec19f21c3
SHA512 c942a16fa9551cbceaaffdcb5b4bf9af3b292cba40e659d603eb852dd69b1e50418025e59cf264e2756b7fbf8c2e2367bb01cd490cbcf12db4b6b9654fe57b90
SSDEEP 6144:04sZBOZdjEYTPXMhaMP/kFTA7OA0BOZdjEYF:0nANL8oq/kFTsOcNF
TLSH
T1E4D41D3406718E04D463C3B42C950D955D6A1EF8CDF86796C707A0AE29BD7FA32AD3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXB4.tmp
Size 532KB
SHA256 cfc6264b8bb2b31aa24fc7ce08748df6ea40291e25de9788867ccd907d7a61f2
MD5 42ab2e4122e4f54256b3d8d0f9915815
SHA1 82ba5b8b66f22560dce771217d2a8adf14e91310
SHA512 d8a1d37ab18f5635eb0ce6e76dcf6ce4dd024bde27c70ee11dffc81bb4995b004aad20edb840650051fa60012c71c9f1a4c907186e860fd39d8d10d8b220e517
SSDEEP 3072:w94sjiJeBjaoadjE5aTtEyXM5hkftw39t+unk++T3mNNb5NOV8aOQzx:U4sZBOZdjEYTPXMhaMP/kFTA7OAy
TLSH
T13EC41C3406B18E04D463C3B42C950D955D691EF9CDF86796C707A0AE29BD3FA32AD3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujdrdzad.exe

Path C:\Windows\System\ujdrdzad.exe
Size 532KB
SHA256 4178315915634fcde2fb0d03f8f695b606b36b8df23e2e65c2e678067720fae8
MD5 7b629616cad15efd0f05182f5c94f763
SHA1 85bcba5b4af0e30a54cc801b3182cb5d41575c39
SHA512 6f38cffb501a857a77756af5ba785f9cd1bfceb07c463ee04052435e5f0ee9bb960b85a36d4ede9365fe3ab3745069e8a086c50ef5a7a9611d99794fb098cf2f
SSDEEP 3072:w94sjiJeBjaoadjE5aTtEyXM5hkftw39t+unk++T3mNNb5NOV8aOQPw:U4sZBOZdjEYTPXMhaMP/kFTA7OAD
TLSH
T10AC41C3406B18E04D463C3B42C950D955D691EF9CDF86796C707A0AE29BD3FA32AD3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cexfv.exe

Path C:\Windows\cexfv.exe
Size 824KB
SHA256 f1d244f5ad5189da5a34ca5e0259d8093721644b3f5d148920f8d3abf1d7ae41
MD5 608dc4f9fb0030e0615932cb5a167678
SHA1 7863916394dba209a4218384fe47400ccd474869
SHA512 a831809bd96406a6fd71799821c4dd694f6ae79585e2b52b6d23f230b6d0934b94fe2fd21a0174002526e0726b83d90cf6f6f682cd3d3fc3f317763eba73f8a6
SSDEEP 6144:04sZBOZdjEYTPXMhaMP/kFTA7OA0BOZdjEYTPXMhaMP/a:0nANL8oq/kFTsOcNL8oq/a
TLSH
T18905FC3406718E04D863C3B42C950D955D6A1EF8CDF86795C707A0AE29BD7FA32AD3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download