908b579f85fdfcdf91b56528d35a7376c82361b7837d13c50f4f2f89e1baf9aa

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
Size 6.7MB
Sample260804-2e69cshg83
SHA256 908b579f85fdfcdf91b56528d35a7376c82361b7837d13c50f4f2f89e1baf9aa
MD5 a6ef663cd84ebf8fd7524dd72ba8c020
SHA1 9d744c0debe542b9a19f531e4f1a5bd6a3b01888
SHA512 e2cb65c2dfcb0b74b82d51f6001da8650e2b517403e3316fac08e40972d7f57cc5b74b08f8a50845c33003393435f0c4f2b810c078fb9c9af72afbac144d46af
SSDEEP 196608:BpqeBGDalH1HzxogQHWANHxYqXB0FcC5I:BpqexdPQ2+HxC/I
TLSH
T19F663310BD69807CC792D376A526BD8AFBB2FE31483805CF2688B65947735491CB533B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3480	MultiAlcorMenu.exe
3540	MultiAlcor.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\36_SA_ED3.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\36_SA_X3_EX.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\41_YM_3D_TLC_X1.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\SCAN_BIN\28_LB_BCT.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_MICRON16_TLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS15_eD3.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_Warmup.bin	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\36_HY3D_V3T.bin	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\DRIVERS\LoadDrv.ini	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\DepLib\FillModuleParam.dll	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\DLL\LLF.dll	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_29_K9GCG_D.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_HY16_TLC_LLF.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_HY16_TLC_MP_EX.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_MIC3D_N28A_TLC_LLF.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS15X_eD3_MP_EX.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS32_D3.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\36_SA_ED3.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\DLL\SETUP_DLL.dll	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_35_K9GBG.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\28_8F_EX3_SD.bin	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\SCAN_BIN\28_E2NAND_SCAN.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\28_MI_X3_1P.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\28_SB.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\SCAN_BIN\28_SB_SCAN.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\28_SD19M_CB.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS3D_QLC_LLF.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_5E_TH_MLC256P_SP.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_HY3D_MLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_MIC3D_B37R_TLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS32_D3.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS3D_QLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\36_HY_ED3_1P.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\41_HY_3D_TLC_v6.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\SCAN_BIN\ShortBootloader.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\28_L85.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\36_HY16M.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\36_L06B_CB.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\DLL\EccParamFile.Dll	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\28_6E_3D_Gen2_SD_TLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\28_HY20M_CB.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_MIC3D_B47R_TLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\41_B16R_CB.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\LongBootloader_Ex_M26ToN28.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_17_16K_UCG256.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_59_HY256MLC.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_7E_SDMLC256_FP_15nm_04.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\28_SD19MX_2P.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_TOS3D_QLC_MP_EX.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\DGD_BIN\36_B27A_CB.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\37_SD19M.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\28_7C_1znm_TLC_SD.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\28_8A_B95A.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\28_8E_EX3.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\28_HY16_TLC_LLF_EX.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\36_L06B.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\36_S14M792.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\DGD_BIN\37_TOS19M.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\SCAN_BIN\LongBootloader_Ex.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\FlashList.ini	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File created	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_27_SD_5D2F.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_Gen\CTL\28\BIN\28_29_K9GCG_D.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\UfdApi\UfdApi_X3\CTL\28\BIN\28_45_K9ACG.BIN	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MultiAlcorMenu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MultiAlcor.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3480	1204	2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe	88
PID 3480 wrote to memory of 3540	3480	MultiAlcorMenu.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a6ef663cd84ebf8fd7524dd72ba8c020_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\MultiAlcorMenu.exe
  "C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\MultiAlcorMenu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\MultiAlcor.exe
    "C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\MultiAlcor.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MultiAlcor.exe

Path C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\MultiAlcor.exe
Size 26KB
SHA256 a3b8bd5c3574136c782c2adbbfb6a3047f55987b334d88a81bbdfdfc8fb8511f
MD5 e7b126708058d6f97e1f14bcae71ce82
SHA1 516a3ed78bed28dab0fd172cceea74405aec7f10
SHA512 9ce5b9ab38354a166fc264e514f0beb9e8a84206213fe9cdf93ac37c899e7378f616e8301559967a7c8d9c84210666382ad264fc65435030a1f298ed03caa4ee
SSDEEP 384:euuokwnwAyhE8Yp1eYoE7sn8ZAwLxK9rI6FMEYk5Lfq/W4yJLkR4jXPl65a3XE96:SXSeY72G6pYqVHbXP4N7koB
TLSH
T159C24B1927E9CB7ACAFE13340872C35127F6D906E643DB5FADA4406B6D633024F82765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MultiAlcorMenu.exe

Path C:\Program Files (x86)\Matin\Matin UFD Recovery\Alcor Micro\AlcorMP v21.01.13.01.X\MultiAlcorMenu.exe
Size 175KB
SHA256 5b5709861d80b710fd0c197d5ef01f480c64b534a4f798e8097e4d8e318127a6
MD5 3a1e013b4e26ed1721ed2e7e42311895
SHA1 8b65727a5e714a9b6b86306363e63157067412d1
SHA512 9f8b768d7a27d8527371f73f189fb55b9d5e95defe8231bfcf1ba8036b008ed490e25b791eb95fa400bf1641df4824d7b102e3ca0c94373ee0f8d05ea37332b5
SSDEEP 3072:7+vlAMRXAQUFYRj3DR2+tqVg9UI1hncm6A0XhB1XNRRzIpIYJ/ln7RpYxu4NNLjH:KvlAkAsl3DR2+Mq9zntr0tdRyIYdEuKF
TLSH
T1C804F11277F0C5BED1A212764E443BA9D2FAE7750610CA076BC40E066F75A46EB1F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3540-836-0x0000000073B62000-0x0000000073B63000-memory.dmp

Download

memory/3540-837-0x00000000006A0000-0x00000000006AE000-memory.dmp

Download

memory/3540-838-0x00000000051E0000-0x000000000527C000-memory.dmp

Download

memory/3540-839-0x00000000058C0000-0x0000000005E7A000-memory.dmp

Download

memory/3540-840-0x0000000005300000-0x0000000005392000-memory.dmp

Download

memory/3540-841-0x00000000051C0000-0x00000000051CA000-memory.dmp

Download

memory/3540-842-0x00000000053A0000-0x00000000053F6000-memory.dmp

Download

memory/3540-843-0x0000000073B50000-0x000000007430C000-memory.dmp

Download

memory/3540-844-0x0000000073B62000-0x0000000073B63000-memory.dmp

Download

memory/3540-845-0x0000000073B50000-0x000000007430C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads