faf454880fe75cad62cf653b2d240bf5af1bb25aced173c6cbe7640759b25c85

General

Target
2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe
Size 5.5MB
Sample260804-hapzqsed88
SHA256 faf454880fe75cad62cf653b2d240bf5af1bb25aced173c6cbe7640759b25c85
MD5 843903160cb005a75a55ed4cafb645b8
SHA1 bfc55cde598dd682869daf7423f2dfbdacec6485
SHA512 7e7f6e807636147816c6a5ed0c3657862f57bd3c3cfd05e79a196979f1d643a97f0231789a72cedd581bfb640032a98cdb239505959185896013ece200f08461
SSDEEP 98304:J/3Lsb6g8W6eDJnoA2RCXyZB6fjt27guesbDHku8wXJUHjKR3thhx2KvFB1:J/3LKn4eDX2RCi7Gp8gtsbLQwXijex2a
TLSH
T1ED46334471C0D025E7E0467E7FA18B2312266D7176A4C1AC33BD84987BE79BC8C75BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2112	eidolon.exe
4948	USBServers32.exe
4808	USBServers32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\USBServers32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\USBServers32.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe
4624	cmd.exe
1224	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBServers32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c406-28.dat	innosetup

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2112	2988	2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe	89
PID 2988 wrote to memory of 4624	2988	2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe	90
PID 2988 wrote to memory of 1224	2988	2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe	92
PID 1224 wrote to memory of 4948	1224	cmd.exe	94
PID 4948 wrote to memory of 2528	4948	USBServers32.exe	95
PID 2528 wrote to memory of 5100	2528	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_843903160cb005a75a55ed4cafb645b8_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\eidolon.exe
  "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
    "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5100

C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
1⤵
- Executes dropped EXE
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USBServers32.exe

Path C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
Size 54KB
SHA256 8f53ab3cd172f685568e0cbb51eb7dfd2389a5fe6aaf47d0aa7d823253e673ee
MD5 6428b1de8971e837926de5b464725f64
SHA1 19d7ce6fff617b790f9de7bf99406e61061f0594
SHA512 7938b01ce48bcdd3276c83f82fc71407d101f2e884b3f271a17fcf4c60af642faf57047edab97906351217f79847107757283af3fbfc3059cf4eb8e8d778d026
SSDEEP 768:nj27aTwKrJgJapOgV0jvQbtgDDM1MEprbhrCTyYrKjA70QkwWyit3JvsgZaphsL7:nj2AwKrSEqLQxK+oyEIXQ7+JLIzbPhwj
TLSH
T1D643D083BA8688E2C410357025977B32CA176FD25085F4A6EF31FDA0E4FF15A942DE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\Temp\tttbrozzz.bat
Size 598B
SHA256 22a9a4c178a401ae36e7b7f84c7297e659cffd73c622a6220160645c09f6a40f
MD5 83bd9a5611a264457e20f2089a9fb42c
SHA1 32577b3d5c798d2d9d4d551774f90dd9524b8191
SHA512 6b229fba8f1399d373fc0091015b2c223adbbd30067bc02fa94c73506cf470b4c687fa430ccd826b78e2c73fda39554d49bbb2835b06e5d9cfd2a1be03796159
TLSH
T11FF02D3842EAC6B65CB590134AEA568DE33078E86F642F104F644D4AE5E144FFA97242
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\Temp\tttdelzzz.bat
Size 313B
SHA256 270dde44f59a8b612b7e671da8a2bac8820c5167b2dde295d787988045f23464
MD5 91ab006eb8998a5d1d6fb2125fd2d02a
SHA1 a05e21037a932969306b78ae918451b44b7eca84
SHA512 ee28f6d0560904051715a228165eaa6d0d49ab947dd65ae3a60fba0aae58945459cc3e47ac2bab1a77c20e73f9b9b2c49b4de5545e500d224d9a09538f834180
TLSH
T126E0723C0AF846A39CB150128BEE1AC9E330BAD91F292F004F348D81E9E104EAC8B142
MD5 SHA1 SHA512 TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 5.4MB
SHA256 07bb70c93cf1886213c4d89a00c0b88a2fba8dd86e248765831ec7866ce6f67c
MD5 bbb1ab345527b79d388aaf8c413ffe01
SHA1 7d3c7a62404fa0e2aad1343d4a2f9c7b06051846
SHA512 57909e78e29994e735c1869607492ba6a68f326b3cc13530fb7f3b296e807f00aebd9edb8ae635219e889b3d7953d2b94219ac0995cccc406f45e78eed05de84
SSDEEP 98304:ZkLpl/xwWYmpGyTeE4w6woZR3enC89egivowoYWGhdpkDvqaUZwNzu:6pl/RdY9E4fwoZVmiwwoc2Dvq9uzu
TLSH
T15A46123FB268A13EC56E4B31067393609A7BBA61791B8C1F47F0445CCF664702E3B666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads