fe778c0c9a5f067496a45474e0f988db8b5f7125b0ca832b4e8c8c4eb8205b8f

General

Target
2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe
Size 920KB
Sample260804-dza5nacc63
SHA256 fe778c0c9a5f067496a45474e0f988db8b5f7125b0ca832b4e8c8c4eb8205b8f
MD5 118ae5d190ca9ace9e5fabbdeb96ec9a
SHA1 b8cec3172ff6b7a56f1e10e74b62a688ae8c97cc
SHA512 bd18440704990a875fa179ac8587c0b4efb2efae69f9a3d361393bb8c2b9b59d17af7f8419ed01730f468f19bdb454209207458eb0be1463fa88fedb076a68c2
SSDEEP 24576:E2yQPx3PGKXdQJN+8gGlFx+buoJE+VIZZ9Cnh/TL:EpI3uKXdUFqI9Y9L
TLSH
T16615124233C4A8F0EA74CA72CF0ED7565673E79927411E5BA6990F522DC36E2530B2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\ccmsetup.exe.download	ccmsetup.exe
File created	C:\Windows\ccmsetup\ccmsetup.exe.download	ccmsetup.exe
File created	C:\Windows\ccmsetup\ccmsetup.exe	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe
File opened for modification	C:\Windows\ccmsetup\Logs\ccmsetup.log	ccmsetup.exe

Executes dropped EXE 3 IoCs

pid	Process
1392	ccmsetup.exe
1348	ccmsetup.exe
1812	ccmsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccmsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccmsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccmsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1392	2496	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe	88
PID 2496 wrote to memory of 4872	2496	2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_118ae5d190ca9ace9e5fabbdeb96ec9a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Support\ccmsetup\ccmsetup.exe
  "C:\Support\ccmsetup\ccmsetup.exe" SMSSITECODE=DSI SMSMP=dssccmap.corp.doosan.com FSP=dssccmap.corp.doosan.com DNSSUFFIX=corp.doosan.com /mp:dssccmap.corp.doosan.com /ForceInstall
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4872

C:\Windows\ccmsetup\ccmsetup.exe
"C:\Windows\ccmsetup\ccmsetup.exe" /runservice "/ForceInstall" "/mp:dssccmap.corp.doosan.com" DNSSUFFIX="corp.doosan.com" FSP="dssccmap.corp.doosan.com" SMSMP="dssccmap.corp.doosan.com" SMSSITECODE="DSI"
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1348

C:\Windows\ccmsetup\ccmsetup.exe
"C:\Windows\ccmsetup\ccmsetup.exe" /runservice "/ForceInstall" "/mp:dssccmap.corp.doosan.com" DNSSUFFIX="corp.doosan.com" FSP="dssccmap.corp.doosan.com" SMSMP="dssccmap.corp.doosan.com" SMSSITECODE="DSI"
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccmsetup.exe

Path C:\Support\ccmsetup\ccmsetup.exe
Size 4.0MB
SHA256 eb319b3f8449f6611efbe3cc9f0bf7594e2e5d57c19832aa9c11ab648477e29a
MD5 3e2221a665c59e58941e7d6876217edf
SHA1 3b7ea3b4cdb0bc218b3e02f74b3af798a533d13e
SHA512 279a2abb66ffc59ea3939d7bc9a27d7f203ec4c6867eea036e26350a4040df4eb7918ba202291775db1862a62657c3b07ebdc92e8f1f6add7c1a3690251902f5
SSDEEP 49152:4sH1AT+DAqHMQr0S69K/jnZmvsRNlQafwOeMOt0JJg8IIWUWvSO5b9UmuWSd4o/U:PHmT+DAqHMQrGs/jZmYNS5OTf2kU
TLSH
T156161C01B6ED6244F7B72EB4ADFEA163497FB9A1AC74C71D8110894E2432E55CCB4F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 286B
SHA256 5b5d97cb1ba6f9be83ba9a1f308c3397ffa1ad1dd3b4f9d82bea57f3f475b2cc
MD5 2143fad472e46eb4160f6d4dda5c70cf
SHA1 135d7179b2151c20d747b5f0189960e20ae4f0fe
SHA512 7d6d72b27d1bd859b7fef3f755e2334cba5a5a0bbf4b4a72366569ea31b306a91db1382961de4d7926d63f1947d3207af74d31dd8993fa31e653303b6cdab037
TLSH
T172D0CD0081BF8A1E2886A02B0AA0704DC870BA941E6B5B5157298C4570C084DBB85361
MD5 SHA1 SHA512 TLSH

Submit Download

ccmsetup.log

Path C:\Windows\ccmsetup\Logs\ccmsetup.log
Size 6KB
SHA256 f7b49c7636838fc7ab351375ef96e91e8eb9a00a6236693205b605e64daa7503
MD5 da37e087fa6cef0330d63a439ef88cc1
SHA1 f4ea6fd0960b6e4a6179ecd5a7125feb5c1d4d98
SHA512 149a6c26ad8a45695161861b5aae34320fcbca2fced0a812f613779f2cae3fb1136a1dc21683e216780699ec4fa2ec617f8e6de36f979079ab3450fea503f883
SSDEEP 96:XxrSWCDL/rLrG3RNhh0E+7zm7h0E+7K0wwC4N9L3Y+3u+05gQWkdAg4gJ9xgnMgG:B0Ez0EDBBnn6jxiT
TLSH
T142D15B21284B5CBC12A01CD14B6E8AD15BABA1DA8410D7B1F325F1B56DC3DE25FAE1F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccmsetup.log

Path C:\Windows\ccmsetup\Logs\ccmsetup.log
Size 9KB
SHA256 4ab95e44c0b82b66961e17443d684e8294ea11d290ecaa73baa34b8275598c02
MD5 590cc38fe266ac23deb1d5f564cf8e13
SHA1 2f643f7ed8e64c5ffe913bba1d925da5bfa6999e
SHA512 a058901db1e671d6915ac196607438fee3fbab380d381ffa1ea4d6c83fca3c5421f907dcb9c03792cff856fba6d776939dc5bb50bee0df133889ef101b0e5dcc
SSDEEP 192:B0Ez0EDBBnn6jxieM0FjDlBfK49kvCNLYRaT:Hel
TLSH
T178128B31244B5CBC16E01CD14B6E8AD15BAB91CA8410D7B1F226F1B96DC3DE25FAE1F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads