Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe
- Size 59.2MB
- Sample260731-3nvscstake
- SHA256 4a2fe541707325e7e13da0cccdaf1334c3882e4e6bfe2a146f308b6a64937aac
- MD5 7ce2837dce48d8c3042244ad15f90c7c
- SHA1 a075e9f0359489d6afc7cdccc6ffe245bf5b40ee
- SHA512 6e6b814fdf3d102be504083b84f6052e9baf3f6fbdd8f748ae28f30e97929a5b0a1ce903ea4a276ff0da90f47206b3a5071bdeb050004428e5473fd89091761a
- SSDEEP 1572864:qz4EXaKG5RbPf4u3ZgrwPoJ/QkmzbAhOoj0J50h:Efpc/3ZgrwPCIPbAhpm5S
- TLSH T18CD73354C68C42A8F91600F8569E9E690E363EF31D29F6F27B213BB094B46D3712E717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3272 INSTALL.EXE 1116 DEL9310.tmp - Loads dropped DLL 3 IoCs
pid Process 3272 INSTALL.EXE 3272 INSTALL.EXE 3272 INSTALL.EXE - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Easy Management\wd230pic.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230rtf.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230wk.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230com.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230rtf.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230sql.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230pnt.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230xml.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\Easy Management.exe INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\fr_FR.aff INSTALL.EXE File created C:\Program Files (x86)\Easy Management\README_en_US.txt INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230cpl.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230ggl.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230vm.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230xml.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\Easy Management.exe INSTALL.EXE File created C:\Program Files (x86)\Easy Management\WDUNINST.EXE INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230barc.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230prn.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\README_en_US.txt INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230hf.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230html.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230uni.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\en_US.aff INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230action.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230cpl.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230xls.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\WDUNINST.EXE INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230mat.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230mat.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230obj.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230ole.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230prn.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230vm.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\en_US.dic INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\en_US.dic INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\UNINST.INF INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230ggl.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230pic.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230sql.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230uni.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230zip.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\README_fr_FR.txt INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230ole.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230action.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230hf.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230obj.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230pnt.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\en_US.aff INSTALL.EXE File created C:\Program Files (x86)\Easy Management\fr_FR.aff INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230barc.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230html.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230mdl.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230mdl.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\README_fr_FR.txt INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230wk.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230zip.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230com.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230grf.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230pdf.dll INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\wd230pdf.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\wd230xls.dll INSTALL.EXE File created C:\Program Files (x86)\Easy Management\fr_FR.dic INSTALL.EXE File opened for modification C:\Program Files (x86)\Easy Management\fr_FR.dic INSTALL.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEL9310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INSTALL.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3272 2376 2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe 89 PID 3272 wrote to memory of 1116 3272 INSTALL.EXE 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_7ce2837dce48d8c3042244ad15f90c7c_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INSTALL.EXE"C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INSTALL.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\DEL9310.tmp"C:\Users\Admin\AppData\Local\Temp\DEL9310.tmp" 876 "C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Easy Management\Easy Management.exe
- Size 12.6MB
- SHA256 e5851524f8924d81931405b9bdb741e2c2e134d0bbb3a28528a5be9f3c9d96dd
- MD5 6dfaf88b44af3bf6667da9e750353b7e
- SHA1 31dc7d3610dc265e938c1b124202cd37292507d7
- SHA512 805d829e87732c46fa2090b13f79c0862b78463ffe468d8f09e62ad58b84ab9851bd271eed84f3f62736f04de3d7c73b0ddcced2dcf4561ac7be28c79f321d3e
- SSDEEP 196608:cRy5HE9I22AZYi2gskK30g1b22xhhWhA/8WiiL/BLLSnb+XZBV:cuk6pYUXr0g1K2xhghSdiEYiXv
- TLSH T1F4D6E051BA008BE3E07C13B949E2ED2430F9BE1849D1450FB9E9767A7B702E76825737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INST.WXF
- Size 80KB
- SHA256 32468a8fde92c3d63bf479d0ee1a74c7646188a06868832bb6fd0d5d2b6cee70
- MD5 c66a210a339acf43250f9b9ac91a0293
- SHA1 39ecebb4f4d4d4c69295a72ab1ef09f18353720e
- SHA512 e22ff90dcf12e199cc33c34d53b2c7d7eeb01bf188e29755ebb7f9482297c73395471492525540f9a20d3ff48956db5677628716998187b1d005b3dfc2975127
- SSDEEP 1536:qVyC0THcjFCr7Rk8bcmAaSR8lSY8sXex2We:qYC0THcjFCr7Rk8bcmAaSR8lSY8sXexO
- TLSH T15683010B33EA1024B3B797589AF554774B27BCD359298C2D44E1534E0AF2E01BEA27B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INSTALL.EXE
- Size 360KB
- SHA256 3560ae7cf9d5148cdb3fcc7274118b2d3a41bfedd37aba70ccf9eed5d77c50de
- MD5 eeaf1c08a22b2cb298d9a742023dbd18
- SHA1 82a5c4867dc7d5fb830928a83750cc69ada7e9c1
- SHA512 947fe7126b42fc5d9b7554c62f33e395ed56d3ea7f75544f35bbae262eba69fdb717c6d3c1207908c31dcdb0625f9fc0c2f9c989b042c632a4dfeea97b603267
- SSDEEP 6144:u55MZmEK60TzD3N4db4g1toa58XFmtXITByv9sFjtBzmM8:uoZpCDNc5ymaTEv9mKM8
- TLSH T1DF74AF0273C005B5F9B319308AEB4D396FBB7C769E31904F9BE4761A69743109226F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INSTALL.INI
- Size 6KB
- SHA256 13736b3c438be5838e33934b0e96e0796fa31fffee853bcf40da9e3e532fd5dc
- MD5 fcb5bfcfbc567e0a0be1f985641d3d5a
- SHA1 bf6d9b49cd601b246285dbb739e1522544e03dd7
- SHA512 9335a933ee2ec52bc79c02c7a1a1698979688c48befd997d2661998bb42b6c0a3289915d82b807671ddb4daeb859a71b1aceb3ce532f26898fda762ad992fa21
- SSDEEP 96:HzNsaKOAz4sItzmkOk4a7nU31AECoLyuz4Gy+mC6F07OJw/wf:TjKOisxmkOkP7nUF9pvy+mCAeg
- TLSH T1EDE1D21277E85115BAF37B42FFF8D1A58B727C86897AD52E12C0450F09F0D449AA2BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INSTALL\_MODAUTO.ZIP
- Size 15.4MB
- SHA256 b2bd28f2a3c65b7ad5ac43a6dfd49ecb19d11c28a2b4792e3d06a23c11ea43ba
- MD5 f609d73a765ab0c9e60197f61b0b4185
- SHA1 a1dd0cbaa0c8f4e8e5d22ba29febb7682bb63fd6
- SHA512 2bfe2b79f047b2c0b4e57443068b8c313103beead2d881cd6cdafde4f0205355c43193711076d95f3fb9c92b548b635908103455c270b7444d81f196b3eef923
- SSDEEP 393216:+aYhHb32J1fRlq2z+m7BdIN1qNazkAz/ldQunwd:7CGJp62zLe1/aMwd
- TLSH T178F6337AD56CC74DEC1640D0167D9E868E3502F74E2267F0732B6AB1A285FD7B0BE608
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\INSTALL\__WDINST.ZIP
- Size 43.7MB
- SHA256 17dc8244973761fd7fe731fb0ef48f8823ca68bcd41e617c97d1cbea395aae17
- MD5 20701b2b1189f59da550a36b42282436
- SHA1 aff7e79e7c5bdcef4c7942a728b3715e6053f449
- SHA512 10a0e3ab917e13deb3335858fa65e6541a895020d772b06d594b2d892581ed880f6010317b49d23e27c733edfcd5ba56b81bb1f7829f7e87902b35f57b6cef87
- SSDEEP 786432:UGvF5bTN0e1/alEVrbt4O9vmxS+qFrIwJryeEgTUJp62VsQFERkEIkr0g+zWdvIj:b3t1/GItvviWGeEgTUT6hQyRkE9wg+ii
- TLSH T1D4A7339BC68C1648B81B00E85A58DE501F3547F319E4FAF36BA12AA0D4E57D360FE70B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_27A3.tmp\install.ini
- Size 7KB
- SHA256 24af8aefa9aa8fe551cf89db9305217e2ab86a6b7806f3c9959f0971af15d449
- MD5 10053162695c00f10e601b0ecfdf0d6c
- SHA1 a1d1d71445baa35b6ceba591d881a5be64a837ae
- SHA512 d6f0913998b6ed909af4d5576ac16c67f7d74bd0bf62df789e70c9eafb56aa42023fb0632aed3c4da74830548d6300334f35c0c480a189ef3dfc0fb516330fbd
- SSDEEP 96:HzNsaKOAz4sItzmkOk4a7nU31AECoLyuz4Gy+mC6F07OJw/wbPlpD:TjKOisxmkOkP7nUF9pvy+mCAeKd
- TLSH T1BCF1E31277EC5115BAF37B82FFF8D1A58B327C95897AD52E12C0444F09F09449AA2BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_2BB9.tmp\wd230hf.dll
- Size 3.8MB
- SHA256 59205bc10f1fcba1976862a4508b17bfc22dd87846b960696a4b4e69cb7b8093
- MD5 21d1d58c3f0e1040eb293655a0436937
- SHA1 409a1b6a0a86103ee0446f68b6c056daa6c37843
- SHA512 2fa54db005ae4b71a092da61a4bf1f1d590404bf00799b5508ae3232e9fa89faec5f9bb0c287c9d61ac82697a48ffa1c064ca76f2d9e0db83e4ee891465734f8
- SSDEEP 98304:PB1YQ0NUjazoKKYmihu/iN6dlVoLmkNOKvBC:UBUjaqYI1oCkNOH
- TLSH T1E616AE0337D1D5A6D26344300E22FB5C63FFFBE08D71574B329D6B2D1EB1A426A6612A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_2BB9.tmp\wd230vm.dll
- Size 4.0MB
- SHA256 1c8ddf7ad5e4b60258d14ccf5db3f8538cc6e14283b255710d147bc5ba012642
- MD5 16ceec3bfb10291fee1f703b1565fc7f
- SHA1 6897debaaea64ff57152bd389a79719908b41675
- SHA512 d9120b2f32a03d0098522d9617efcb6826e7bb0809a64844fd2a51d5df981c77052cc5291ba985982eca0d2c33d8a2648ba38119ef2a6fef8105ea308e6c65a9
- SSDEEP 98304:bFstHdP6faUF4mm8DEyV2iAHs+9IMJHhXE1:bFst9P6So2dHxHhXO
- TLSH T163167D10B956DA7BDBD116F00FBD6F2E21AC9A8D0B7099C3E5D41D3C4CB16C21E3A91A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WD_2BB9.tmp\wdmod230.dll
- Size 1.7MB
- SHA256 73222f9ff376ada4892f516b4f11e1917124980665409f2f256626c468cf1ce0
- MD5 c3b8d33bb204d87a2c226c835ffa0743
- SHA1 0216882f8a5adc263e31f72a9f8fd5ce040e928e
- SHA512 d11b4561d02d68d779a4a0bf7dede9aa805c07201b2fe929b96649490483353d6bbe11c147421fdb398e5baea49906438741ef3abac05896cdf9ba77e3223fce
- SSDEEP 24576:nf0iqcNjmRweTf6/YAl41Yy6IzvbZzBzLWc/07ih4r+jskxReILknYuyxFPvsPu:MiqXweumYyZbVRWO0/IReIEjyxFXsPu
- TLSH T1ED85F1117581E873C1EE50B125AED76631B9BDE06AA20DAB73CCEEEC2F349402535367
- MD5 SHA1 SHA512 SSDEEP TLSH