e1ad81b18af6c860515dd2b084133343821dc7ebe42acb8810f05669ca0352e3

General

Target
2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe
Size 1.6MB
Sample260801-b3kgdsbf72
SHA256 e1ad81b18af6c860515dd2b084133343821dc7ebe42acb8810f05669ca0352e3
MD5 0a2330e3d630f118d031fb147f95c1f3
SHA1 2734c232f4b31ef2cdec140cbe3ae29a20ff1534
SHA512 25f1bf9135817d21ac7ac9f4a502da2da6c16b6e1f08651b188249f61c8648b5a22d6003e97721900a2d0e35b6ccdd1caef6df0e1b8b7a963188f0545c47f91e
SSDEEP 24576:aetLD/nDtBHD8RCj2+FbJZy4feu1+cBUyD2nHMSKUGkOF853pIEJrQMykHdqc0op:BDLtB8RCb5JZy42rPeUGkOcuEJrQPkP
TLSH
T18275F1F1B618AD47D41AF773B23D583D92324FAB19A0C21E2AA5BC7503BB6C27548C47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5988	sqlserver.exe
3084	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe
1840	dumpkernel.exe
4648	dumpkernel.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kernelfaultEx = "C:\\Windows\\SysWOW64\\dumpkernel.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dumpkernel.exe	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2816	cmd.exe
4608	cmd.exe
6088	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	5988	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumpkernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumpkernel.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3084	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe
3084	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5988	4836	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe	88
PID 4836 wrote to memory of 2816	4836	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe	90
PID 4836 wrote to memory of 4608	4836	2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe	92
PID 4608 wrote to memory of 3084	4608	cmd.exe	96
PID 4608 wrote to memory of 1840	4608	cmd.exe	97
PID 1840 wrote to memory of 6088	1840	dumpkernel.exe	98
PID 6088 wrote to memory of 2464	6088	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\temp\sqlserver.exe
  "C:\Windows\temp\sqlserver.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 256
    3⤵
    - Program crash
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_0a2330e3d630f118d031fb147f95c1f3_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3084
- - C:\Windows\SysWOW64\dumpkernel.exe
    "C:\Windows\system32\dumpkernel.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\windows\currentVersion\run /v kernelfaultEx /t REG_SZ /d "C:\Windows\SysWOW64\dumpkernel.exe" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\windows\currentVersion\run /v kernelfaultEx /t REG_SZ /d "C:\Windows\SysWOW64\dumpkernel.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5988 -ip 5988
1⤵
PID:3480

C:\Windows\SysWOW64\dumpkernel.exe
C:\Windows\SysWOW64\dumpkernel.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dumpkernel.exe

Path C:\Windows\SysWOW64\dumpkernel.exe
Size 45KB
SHA256 5ab216e47aacc708f131df45f4e14d299091cd2f351a62e522a16f41dc784aee
MD5 1485a63020ec124ca6e16c05cf6a643a
SHA1 7036708ddb8c575ce72f13856bada6cf17064b09
SHA512 b8db918e676c1a5f5b16c74c46c0fd1d738b20141b2c3842ed0a1dc968f1bb6e83cb7ddf9b1dcd5da9d0eced77dff79f5c752c7f0784b383779a9490c48fb0c4
SSDEEP 768:7m16Gr4CrJgJUwdOgVx0r7R1DhhSakiAmYgpk8AdJGaoM8ol3/USz:7m1n4CrSuwbW73hhEiA+pk8oJGap7
TLSH
T10523BF57BF9605B2C82513B425D73B728A21B9944041F525DB36FCB264EF160E829E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlserver.exe

Path C:\Windows\Temp\sqlserver.exe
Size 15KB
SHA256 ef0c4a682fd6c3131765f5000bb4fa7548502960ce960dad4ecd853288720f4e
MD5 4b0afd8530ab27f9d30a97a5135e4430
SHA1 6f859d390d6a6e1a55b565c9133fb5f80a38acce
SHA512 65177cda13ed25ec61effe422af825c769b00bb77f9fc05982ff39fe1d9cd7485cd5091b73dc6290ab9c02e827ccb347f81d117b38e8c1102938c359af91f526
SSDEEP 384:y4Od9Q2hJy5g75oOuHh7parHdAcUVbK4S4YkWL70V2GlNNc:y4aQ2hJyjOuHhwUVIHVQNi
TLSH
T1EF628E49B6919703D48080F23BBC7F39E7F9B87739684497EB10CD44A9694C9B10B74E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\Temp\tttbrozzz.bat
Size 582B
SHA256 59695a90cdf9da9eba13f81441d7c5caba1ee93401004c5ff27f5d6cb020b266
MD5 55579d56bfd8613e918b8a9684dcd81a
SHA1 b0a365ab3a8adf97a815f956f2b06519c4e4478e
SHA512 bb57422c81994d057027cc8dbaaccae0cb7f79293bfdfd21cea9d9a42622682dd1794423b4888df399aed1834fa24a9783c582b3e63a7fa0c3edae25d1bd4a2d
TLSH
T1D9F0811441FE85E69C7DD0228EA7561EE2A0F5556F561F140F288B0AF19480FFFE3241
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\Temp\tttdelzzz.bat
Size 313B
SHA256 b4086ee77a4b155d8363b3f9502c53625a3b2c6ba0c1337b933210d997baac72
MD5 6ee17ff23849f1eb38434ebca7188891
SHA1 63da864bf2f535ed53b8d570e3469f05ea3e4188
SHA512 690fb1232cd83d23bcfa7682b85b0b286ab0bc3a175048fe971b55a885b2e9531c02511e6e7cf981bdc8cb834a096d19e621a47ec79cc172178394ca50d65e6d
TLSH
T1C4E0C21854FD46D3CC7D9126CBA70A0DEAA0FA8A1F0B1F690F2D8A45F59580FBEE7141
MD5 SHA1 SHA512 TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 1.0MB
SHA256 203e5ca5e69dc2c216a8b254e56bc4fb48124da58894301b8e6bc9015d2537bc
MD5 369b9c98621313a58671a9ad18bf73c7
SHA1 74a1fdd2a7b6afd11b668d0b352718fe7c55e221
SHA512 67adf38baaa06be8256d9446303a4fab3fdd0d66bec74df70e0e74e4f763486fe922f643e448923cb25adae328735bfc01562e7477688a02f8ce241a4a21e2e4
SSDEEP 24576:rH//fNPVSS5DUz8FtLD/nDtBHD8RCj/M3:V7DLtB8RCjM3
TLSH
T11E35F4E2E66990D3D036D13AA162593AE572BE570B3087CB9551BE360F337D0A939F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads