ad7ee31f3a4444a71b1c7e251dac52256887eff644dcfb6cd7bfddea49ccf2a3

General

Target
2026-08-07_14a3e931de276a03ece6a58995471d77_elex_wannacry.exe
Size 38KB
Sample260807-metwpssgpb
SHA256 ad7ee31f3a4444a71b1c7e251dac52256887eff644dcfb6cd7bfddea49ccf2a3
MD5 14a3e931de276a03ece6a58995471d77
SHA1 c8be6b99dcd478e2d9aeba660f9c66b57862f4ef
SHA512 042ad6ade5649257b8f4d574b004360f69e39bbb4cc3622f7ea51258692c4f417a53394bbe32b497982283f38b754a29803c69ad3a17c7ff01c0ef884597a659
SSDEEP 768:fZjIoksdZlOvrA9DvsLKDrnuIeQTls5SQ48NPKQHDFw/Bh2+aBrI:RjwsdXOvrA9DvsLKfuIbBskQ4nsFwSrI
TLSH
T1B5038D06BA41D123C28A84B0D03D67F58C3DEC7A8522249BD7747E2A387CD729962F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5560	vmplayer.exe
1964	vmplayer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmplayer = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\vmplayer.exe -r"	vmplayer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_14a3e931de276a03ece6a58995471d77_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vmplayer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2152	PING.EXE
2000	PING.EXE
5076	cmd.exe
5912	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5912	PING.EXE
2152	PING.EXE
2000	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 5560	2596	2026-08-07_14a3e931de276a03ece6a58995471d77_elex_wannacry.exe	89
PID 5560 wrote to memory of 3300	5560	vmplayer.exe	90
PID 5560 wrote to memory of 5076	5560	vmplayer.exe	91
PID 5076 wrote to memory of 5912	5076	cmd.exe	93
PID 5076 wrote to memory of 2152	5076	cmd.exe	94
PID 5076 wrote to memory of 2000	5076	cmd.exe	95
PID 5076 wrote to memory of 1964	5076	cmd.exe	96
PID 1964 wrote to memory of 2172	1964	vmplayer.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-07_14a3e931de276a03ece6a58995471d77_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_14a3e931de276a03ece6a58995471d77_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe
  "C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe" -r
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\system32\pcaui.exe
    "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {43edc3a4-e400-4e09-bc67-4e0730eb5590} -a "VMware Workstation Pro" -v "VMware, Inc." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 2109246 -k 0 -e "C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe"
    3⤵
    PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2&del "C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe"&ping 127.0.0.1 -n 2&rename "C:\Users\Admin\AppData\Local\Mozilla\00004647" vmplayer.exe&ping 127.0.0.1 -n 2&"C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe" \r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5912
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2152
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2000
  - - C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe
      "C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe" \r
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\Windows\system32\pcaui.exe
        
        "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {43edc3a4-e400-4e09-bc67-4e0730eb5590} -a "VMware Workstation Pro" -v "VMware, Inc." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 2109246 -k 0 -e "C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe"
        5⤵
        
        PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00004647

Path C:\Users\Admin\AppData\Local\Mozilla\00004647
Size 38KB
SHA256 7c620fe99cff40383d6e17c4c1ad8ecb328c55213a0a8d0611a724e831fe4f1e
MD5 48557b4d7d5a427829784f2f2c2f8ead
SHA1 6f4605f09e73575e23df00867cbc09a1d2c7078a
SHA512 6ef61542e7c2dc7663c2755fb725ee809fb924045a8524e0d6b5908ce9bc235bba7236634caa434a351d7555e93cc4bfe208e0f11c8078822d379b6cf84e4e3b
SSDEEP 768:fZjIoksdZlOvrA9DvsLKDrnuIeQTls5SQ48NPKQHDFw/Bh2+aBrf:RjwsdXOvrA9DvsLKfuIbBskQ4nsFwSrf
TLSH
T112038D06BA41D123C28A84B0D03D67F58C7DEC7A8522249BD7747E2A387CD729962F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmplayer.exe

Path C:\Users\Admin\AppData\Local\Mozilla\vmplayer.exe
Size 38KB
SHA256 ad7ee31f3a4444a71b1c7e251dac52256887eff644dcfb6cd7bfddea49ccf2a3
MD5 14a3e931de276a03ece6a58995471d77
SHA1 c8be6b99dcd478e2d9aeba660f9c66b57862f4ef
SHA512 042ad6ade5649257b8f4d574b004360f69e39bbb4cc3622f7ea51258692c4f417a53394bbe32b497982283f38b754a29803c69ad3a17c7ff01c0ef884597a659
SSDEEP 768:fZjIoksdZlOvrA9DvsLKDrnuIeQTls5SQ48NPKQHDFw/Bh2+aBrI:RjwsdXOvrA9DvsLKfuIbBskQ4nsFwSrI
TLSH
T1B5038D06BA41D123C28A84B0D03D67F58C3DEC7A8522249BD7747E2A387CD729962F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads