7bb8776c7ea6db9e8c09c5584dfab8f18790ef1a8a001465385308be6969009d

General

Target
2026-08-01_55725d0c46d016f488245302e4ce17ae_elex_wannacry.exe
Size 6.7MB
Sample260801-dvr8davxbs
SHA256 7bb8776c7ea6db9e8c09c5584dfab8f18790ef1a8a001465385308be6969009d
MD5 55725d0c46d016f488245302e4ce17ae
SHA1 9c0cb98cfffa3214bcc539515b5462f6d9e2786e
SHA512 191a083f7ea21622d47775727d37eeeafe5e85b266bed13689a69a2d154bf28122749a93529861ff0712617bc090b700cd58651b7934e691ed0c03b809ecfdb7
SSDEEP 196608:CpbeHeTzRLMSgvoQSdmKyx9VEi+VwHPxgni0maeVf:CpWepvgHSdmKI7uwvx5aeVf
TLSH
T1C56633D372026C7BD39269BF4B9C8BFCD065E7D8263A3203F7924E9160557D88D4B12A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4612	打印机驱动安装.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_55725d0c46d016f488245302e4ce17ae_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	打印机驱动安装.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	打印机驱动安装.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	打印机驱动安装.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	打印机驱动安装.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	打印机驱动安装.exe

Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3184	2026-08-01_55725d0c46d016f488245302e4ce17ae_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4612	打印机驱动安装.exe
4612	打印机驱动安装.exe
4612	打印机驱动安装.exe
4612	打印机驱动安装.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4612	3184	2026-08-01_55725d0c46d016f488245302e4ce17ae_elex_wannacry.exe	89
PID 4612 wrote to memory of 3576	4612	打印机驱动安装.exe	90
PID 4612 wrote to memory of 2636	4612	打印机驱动安装.exe	91
PID 4612 wrote to memory of 5008	4612	打印机驱动安装.exe	92
PID 4612 wrote to memory of 5844	4612	打印机驱动安装.exe	93
PID 5008 wrote to memory of 5028	5008	net.exe	98
PID 5844 wrote to memory of 5324	5844	net.exe	99
PID 2636 wrote to memory of 2552	2636	net.exe	100
PID 3576 wrote to memory of 3312	3576	net.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-01_55725d0c46d016f488245302e4ce17ae_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_55725d0c46d016f488245302e4ce17ae_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\QiRui_AiYin_0\打印机驱动安装.exe
  "C:\Users\Admin\AppData\Local\Temp\QiRui_AiYin_0\打印机驱动安装.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\net.exe
    net start spooler
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start spooler
      4⤵
      System Location Discovery: System Language Discovery
      PID:3312
- - C:\Windows\SysWOW64\net.exe
    net start stisvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start stisvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2552
- - C:\Windows\SysWOW64\net.exe
    net start DeviceInstall
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start DeviceInstall
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
- - C:\Windows\SysWOW64\net.exe
    net start DsmSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start DsmSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\QiRui_AiYin_0\config.ini
Size 270B
SHA256 8ab0b5aa2f28f09c86aeb0a42fa0056673935928884580a34a8e3b097da335ac
MD5 505bfeda03e7303f6cefc499a7f3a8aa
SHA1 1e0a8ae8870447f95026e056e00b0896a82810cd
SHA512 faee223ddbf62bb7399bf5ccdd605890d4f1fad377a28128396d0f5654e56324424c0ab576e5d3b9ff52c5bb18cfc36fe10c0f4908e0e71955b4bc16621c89c1
TLSH
T1D8D05E547826EC97C26EB26C7723E0D0A95EC04078F59300DDE790C39E1899CA39E9A7
MD5 SHA1 SHA512 TLSH

Submit Download

打印机驱动安装.exe

Path C:\Users\Admin\AppData\Local\Temp\QiRui_AiYin_0\打印机驱动安装.exe
Size 1.2MB
SHA256 1fe2918fac6b55f7b7ab33791cd6492015aff7ccc1364b63d28ce2aa95136a83
MD5 60741dfbb32a6f407bfdc187656a2696
SHA1 ffbc58973fcf5e141eae966cb8a0a56098211366
SHA512 9041aa2437c4daeb06a2b2e62520e07d9a3dd325196bd81661332a33fe6eb6711491ecf34153c7fdd9c7998a32eb0cde7dda799749ac763621b8d2f1c422e93b
SSDEEP 24576:4s23iesY80z5zb+Ao3mW2cB2dC5zjBGLkbOF0DXc6TynNkN6o4lVW/+gwv0Xl7jd:t6h80z5zb+Ao3mW2cB2dC5zjBGLkbOFs
TLSH
T117551710F19041B3E0D61CB0B989F4A5FC4922947FDEBA93BEA6C91DABB5DB0512443F
MD5 SHA1 SHA512 SSDEEP TLSH