b63a6a749a47fa6f2e816433838146e5459d5f3f9a70621b22da3f11fa0f1ad5

General

Target
2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
Size 30.3MB
Sample260808-c1ghdsbb96
SHA256 b63a6a749a47fa6f2e816433838146e5459d5f3f9a70621b22da3f11fa0f1ad5
MD5 e2cf6471c8ec6db3e33aacecf5fca7b7
SHA1 cdd547fcfc4ff1f051392f8ddf77ebb4dbf4adb6
SHA512 811e9fdcc3e709c91242fb4f72baf3a8a5e2447275d345bb98adf896396d5437354e0440b6c731d47f10d0aeab64a3365110bfc462acc4c16e36a9f72dba9a43
SSDEEP 24576:F0Hp0zbLxjwOtYsssssssssssssssssssssssssssssssssssssssssssssssss0:W
TLSH
T1BF67D1CD057B11B48633A43177D210A5358146A596B0C92F8ADBEFE5F8CA4EF393A6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1688	Explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
1688	Explorer.exe
4492	explorer.exe
2348	Explorer.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ufeczujuuu\Path.rcd	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
File created	C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Ufeczujuuu\2000	Explorer.exe
File opened for modification	C:\Program Files (x86)\Ufeczujuuu\20766	Explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	Explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe
1688	Explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1688	5088	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe	85
PID 1688 wrote to memory of 4492	1688	Explorer.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe
  .
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Cymgvf Oabitvie\explorer.exe
    explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4492

C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe
"C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorer.exe

Path C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe
Size 35.3MB
SHA256 33f77f8b1a867214ca8ff828bf5f5fdd181662da6a396cbfac2e602cd637249e
MD5 e33df28fe802b0d791caa6c74297933f
SHA1 48b7b7770a677201266976992e2467e5f42b73d6
SHA512 65d48c97f5afb05c2564e95c2c73480acdc964552dd84ad3092e2d4ae6a03428f755d51955a49026a3f9c2ca1bdf5f70c7fa0747e63291ff0a9681f7568266d9
SSDEEP 24576:F0Hp0zbLxjwOtYssssssssssssssssssssssssssssssssssssssssssssssssss:+
TLSH
T1F287D1CE043729F09537D5317BE610B1364085A46BB4CC6F8997AF99B88D4EB393A783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2000

Path C:\Program Files (x86)\Ufeczujuuu\2000
Size 10KB
SHA256 9558cac8ba04f59f687106a4bd00acdcd2458f013f8240d5b86040999f86ccc3
MD5 5d8195fd596605c428784bf98628dc1b
SHA1 5505450d7b529e7426bd35d9e79de952124739d2
SHA512 a6bd3d20ebc0cec5c4a06873a66ec2a75a932cc9bb6835405bd8c1f61e59285855e3e80f96b868c5dad66f229b92bc8048da511ab891ae68928aab47ecbc6b00
SSDEEP 192:dkyiVL8rA2n6iWpi5hXV45hXVnTY+DyPSn/9JXnvYmq2bNWEt:d6VLOJ0J1TY+WPSlRQwxpt
TLSH
T1B8221361CB8BC68C803196115E2EF1D4EAD37721D6D1B480D2F495BA1D61E3E8F28F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path.rcd

Path C:\Program Files (x86)\Ufeczujuuu\Path.rcd
Size 260B
SHA256 4239c2f65f1b4b90afb1d9cc4b1d0c6e816bf18a536240e7b0710992e0c18db9
MD5 91489eb3d3f50d53972c328e923c53ab
SHA1 77ab10bd7c55e92e9fb68fee4781868c294fe730
SHA512 dbca297991c1b4ed764ad95f6c961deb10b86b3359928eac70b78e253a8a49743c826a0d74eded4c32673ad1fe3e4050960c7bc11b177f0d320a9fdd45214f6d
TLSH
T113D0121049BE4611DC2160778D611509E0B23A04DB356B608B50851775C144DF88A106
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads