fe778c0c9a5f067496a45474e0f988db8b5f7125b0ca832b4e8c8c4eb8205b8f

General

Target
2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe
Size 920KB
Sample260804-dza5nacc63
SHA256 fe778c0c9a5f067496a45474e0f988db8b5f7125b0ca832b4e8c8c4eb8205b8f
MD5 118ae5d190ca9ace9e5fabbdeb96ec9a
SHA1 b8cec3172ff6b7a56f1e10e74b62a688ae8c97cc
SHA512 bd18440704990a875fa179ac8587c0b4efb2efae69f9a3d361393bb8c2b9b59d17af7f8419ed01730f468f19bdb454209207458eb0be1463fa88fedb076a68c2
SSDEEP 24576:E2yQPx3PGKXdQJN+8gGlFx+buoJE+VIZZ9Cnh/TL:EpI3uKXdUFqI9Y9L
TLSH
T16615124233C4A8F0EA74CA72CF0ED7565673E79927411E5BA6990F522DC36E2530B2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\ccmsetup.exe.download	ccmsetup.exe
File created	C:\Windows\ccmsetup\ccmsetup.exe.download	ccmsetup.exe
File created	C:\Windows\ccmsetup\ccmsetup.exe	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe

Executes dropped EXE 2 IoCs

pid	Process
4516	ccmsetup.exe
1212	ccmsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
656	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccmsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccmsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4516	1276	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe	86
PID 1276 wrote to memory of 656	1276	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Support\ccmsetup\ccmsetup.exe
  "C:\Support\ccmsetup\ccmsetup.exe" SMSSITECODE=DSI SMSMP=dssccmap.corp.doosan.com FSP=dssccmap.corp.doosan.com DNSSUFFIX=corp.doosan.com /mp:dssccmap.corp.doosan.com /ForceInstall
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:656

C:\Windows\ccmsetup\ccmsetup.exe
"C:\Windows\ccmsetup\ccmsetup.exe" /runservice "/ForceInstall" "/mp:dssccmap.corp.doosan.com" DNSSUFFIX="corp.doosan.com" FSP="dssccmap.corp.doosan.com" SMSMP="dssccmap.corp.doosan.com" SMSSITECODE="DSI"
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccmsetup.exe

Path C:\Support\ccmsetup\ccmsetup.exe
Size 4.0MB
SHA256 eb319b3f8449f6611efbe3cc9f0bf7594e2e5d57c19832aa9c11ab648477e29a
MD5 3e2221a665c59e58941e7d6876217edf
SHA1 3b7ea3b4cdb0bc218b3e02f74b3af798a533d13e
SHA512 279a2abb66ffc59ea3939d7bc9a27d7f203ec4c6867eea036e26350a4040df4eb7918ba202291775db1862a62657c3b07ebdc92e8f1f6add7c1a3690251902f5
SSDEEP 49152:4sH1AT+DAqHMQr0S69K/jnZmvsRNlQafwOeMOt0JJg8IIWUWvSO5b9UmuWSd4o/U:PHmT+DAqHMQrGs/jZmYNS5OTf2kU
TLSH
T156161C01B6ED6244F7B72EB4ADFEA163497FB9A1AC74C71D8110894E2432E55CCB4F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 286B
SHA256 5b5d97cb1ba6f9be83ba9a1f308c3397ffa1ad1dd3b4f9d82bea57f3f475b2cc
MD5 2143fad472e46eb4160f6d4dda5c70cf
SHA1 135d7179b2151c20d747b5f0189960e20ae4f0fe
SHA512 7d6d72b27d1bd859b7fef3f755e2334cba5a5a0bbf4b4a72366569ea31b306a91db1382961de4d7926d63f1947d3207af74d31dd8993fa31e653303b6cdab037
TLSH
T172D0CD0081BF8A1E2886A02B0AA0704DC870BA941E6B5B5157298C4570C084DBB85361
MD5 SHA1 SHA512 TLSH

Submit Download

ccmsetup.log

Path C:\Windows\ccmsetup\Logs\ccmsetup.log
Size 6KB
SHA256 abecfdfbddc29a5cee23f790993559dfe351d051db8a900a905122c75f2a8148
MD5 dc4cfb579ebdbac327dfaf00a807a072
SHA1 eee650e7b0f8c4cc6e9955e3255942ca85be71c4
SHA512 f15c2af010a875b9bae19e8165271a721097507591a83b49fb8b0a9faf18c833cbe55ade466547bd6f0383e62ab5eb1a0dfd3c977777154ca47bb711358e0a16
SSDEEP 96:Xp+u8Q9L+NLcxVv7hh0E+b5adh0E+bQ0Y+LGn/Cb6I6JgqwiFkAKnc1O2dBIb:J0Ev0ERQF
TLSH
T164D13B31395BDC6C11A05CD1476E89D05BAAD28A8400E7F1A325F1796DC3DA2AFAE1F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads