Analysis
- max time kernel
150s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe
- Size 55.1MB
- Sample260804-pdhhdsag52
- SHA256 0af7152d1a554e665eaac9cbbec3d9c5759b8b9ddab71deae1fcf3828c33b2e4
- MD5 45ebb7480ad70a72e7c4d586a448098a
- SHA1 0193cd7ec7d4e4cfc40f02cff112990edf8c8b60
- SHA512 b0518110019237bc5c8211e7e8f5d3534717bf53b1e890fecfb86222b7521ac3711645a4ece35f674b38af49d8b6ea736d92364ce9c7e6b32dc46eaf09ff4cec
- SSDEEP 1572864:i2PGA+OhynJ5snZdXL7+uz5QKj1FsidDXv:t+ROh2J5Ej7dz5QKnbv
- TLSH T15EC733E612C85F66FFECCE77C1A1A125451D7D370A44982B7938B720B873846627E8F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 5544 cscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 4252 msiexec.exe Token: SeCreateTokenPrivilege 1116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1116 msiexec.exe Token: SeLockMemoryPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeMachineAccountPrivilege 1116 msiexec.exe Token: SeTcbPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 1116 msiexec.exe Token: SeTakeOwnershipPrivilege 1116 msiexec.exe Token: SeLoadDriverPrivilege 1116 msiexec.exe Token: SeSystemProfilePrivilege 1116 msiexec.exe Token: SeSystemtimePrivilege 1116 msiexec.exe Token: SeProfSingleProcessPrivilege 1116 msiexec.exe Token: SeIncBasePriorityPrivilege 1116 msiexec.exe Token: SeCreatePagefilePrivilege 1116 msiexec.exe Token: SeCreatePermanentPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 1116 msiexec.exe Token: SeRestorePrivilege 1116 msiexec.exe Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeDebugPrivilege 1116 msiexec.exe Token: SeAuditPrivilege 1116 msiexec.exe Token: SeSystemEnvironmentPrivilege 1116 msiexec.exe Token: SeChangeNotifyPrivilege 1116 msiexec.exe Token: SeRemoteShutdownPrivilege 1116 msiexec.exe Token: SeUndockPrivilege 1116 msiexec.exe Token: SeSyncAgentPrivilege 1116 msiexec.exe Token: SeEnableDelegationPrivilege 1116 msiexec.exe Token: SeManageVolumePrivilege 1116 msiexec.exe Token: SeImpersonatePrivilege 1116 msiexec.exe Token: SeCreateGlobalPrivilege 1116 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1116 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1116 msiexec.exe 4252 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4824 wrote to memory of 5544 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 89 PID 4824 wrote to memory of 1116 4824 2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_45ebb7480ad70a72e7c4d586a448098a_dosia_elex_wannacry.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cscript.execscript.exe /nologo "C:\Users\Admin\AppData\Roaming\feiniao\adddf.vbe" C:\2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:5544
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\genteeFC\feiniao.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\genteeFC\feiniao.msi
- Size 35.1MB
- SHA256 42732e5c43b27853eddbdf39933251ed5ecebcf3ecda042c04c976ac26dd0dbf
- MD5 005177066990d6f79bdbd96715b4ad78
- SHA1 5d3c2f5434896d2e12e487d3db78b4ba54f76908
- SHA512 ad0cbd99d7957ff877ddea203aef7c7cc530a371d55ca521109e8f73fcb92d788adfe3da70d17f6740fb7d7602b6658f45bce450bbaa4ef88512e64235b3f8f1
- SSDEEP 786432:wEfZGGzl/XN9xl+uB+ZAXelbjrvA9glHY1gqBJctOJ/xI5y1bM1nE3t:bZDXL7+uPXom51HcU1xp5
- TLSH T1E587335B3EC54F21F6F66F7245B5CB64422A7D220690890B7A50BB3CECF28C169789D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\genteeFC\guig.dll
- Size 20KB
- SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
- MD5 ddd4a31094764a9deb6a82c8658fd9c5
- SHA1 4c098a5b44aca27b13222dd64903d3fb286fc274
- SHA512 45e2b5373ceb9b92dcd1d23a0b2410b5562d2a59c2a0d4dbca1c51f6264bc4659370ae3c170662bb8d316c3dfc0439874b3354ebf1ecd7ea27de125b4975ba6e
- SSDEEP 96:Vp+rqxZxbVbQosZK61Oi0sIqUWfNBd8HwoO6EVV2JVdY0l4RSID1/Qw/g3ATg:+OLOK6UsPnzB6aVd0AD1/Qw/g3
- TLSH T17D92D6B672D148F3D0CF17F00A622BAE6BB58420177578A64A134BCE96A6641F926B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\genteeFC\unppmd.dll
- Size 8KB
- SHA256 d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d
- MD5 7b97f7a822f0f4f54c54b8ef92aaf09a
- SHA1 d0916590b36d8e0507b6722449d7ffd2187498a6
- SHA512 d33c0c31df17738f0cd5384f579bacb512668ec8fec9c96e12125ffe58a38a46ac498f5924c8620a146b762fc318dd7f291efd27caaec45ca9f16d80dae05387
- SSDEEP 192:8oZxb6fmKexmyVMoScaVqAbQkomcOqLPW3axP:82xGfm1mm9SZVWko7zW3
- TLSH T1AA024B62CD9231F2F6898A7D08CBB357D6BDA7005F40D47E5B2E467D6D281B4AC33242
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
- Size 60KB
- SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
- MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
- SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
- SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
- SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
- TLSH T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\feiniao\adddf.vbe
- Size 9KB
- SHA256 4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822
- MD5 9a61b0b598accb28f85ef37a3ddb0ac9
- SHA1 be606c84b9adc32097377ebe7181a38f705bbcfc
- SHA512 b5fd3086e299419228f7225f39e8fc5111fd17985a1408de64b083e5d077b4bfb003679d3ff0de609dc506937fedecdf1f30a0aa81a168fda5305783aec06943
- SSDEEP 192:UK/4eC2uWB9XN5JLoQUlYf0Kd7IeHpySDdKwi9SK6DLXkDxW:ZQP2uyb6S0KlzHpySDo7SK6DIxW
- TLSH T1E612195C021093408EFC9172ADCB19AE771FDE9046C96991E58CED8CF5DE2BC40AE7E5
- MD5 SHA1 SHA512 SSDEEP TLSH