Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe
- Size 7.6MB
- Sample260808-deacmabc99
- SHA256 10b44f11cdf2c999b666cab1ec6fd167bb59b3cdb4c547236a62ed73e594c0ac
- MD5 b2497f87da3171adf68a2a0722ffe0fd
- SHA1 0350d6da2ded9159ebc45aee94640069c01c96ec
- SHA512 7358b987162c8a47a2672878e13e9d60b4197637022cec178e416afe64d59eda844b0a81ddbd816645b940f3d0530436fe24fe07e26f681e138bee47e799885c
- SSDEEP 196608:zbf60JnP1EYNLGwSzqJ4dUEEyFKKYA/YeVI:HBJP1Ecwn5ElURVI
- TLSH T1338633F5FF023DB5C1B6F934240B8B7E667018A629834FE523427E5A5C4A11EEE27097
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5440 servbrow.exe 4408 servbrow.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\info_48[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\navcancl[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\navcancl[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\ErrorPageTemplate[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\ErrorPageTemplate[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\background_gradient[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\bullet[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\httpErrorPagesScripts[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\errorPageStrings[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\errorPageStrings[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\httpErrorPagesScripts[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\background_gradient[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\bullet[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\info_48[1] servbrow.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\Ws2Help.dll 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\Ws2Help.dll 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe File created C:\Program Files\7-Zip\Ws2Help.dll 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\Ws2Help.dll 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\servbrow.exe 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language servbrow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language servbrow.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.26100.1301\"hypervisor=\"No Hypervisor (Microsoft Hypervisor with SLAT support detected)\"" servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" servbrow.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTcbPrivilege 5440 servbrow.exe Token: SeChangeNotifyPrivilege 5440 servbrow.exe Token: SeIncreaseQuotaPrivilege 5440 servbrow.exe Token: SeAssignPrimaryTokenPrivilege 5440 servbrow.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3448 2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe 5440 servbrow.exe 4408 servbrow.exe 4408 servbrow.exe 4408 servbrow.exe 4408 servbrow.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5440 wrote to memory of 4408 5440 servbrow.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b2497f87da3171adf68a2a0722ffe0fd_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3448
-
C:\Windows\servbrow.exe"C:\Windows\servbrow.exe" /Service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\servbrow.exe"C:\Windows\servbrow.exe" /Popup2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4408
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll
- Size 7.6MB
- SHA256 75114e202152453a5378d0c5c2e6a9c5eb32986605f3d611ed886a9309153abb
- MD5 fbc3613c847502cfe99a39b5f41bb480
- SHA1 f2b49ec1103f8193af8495fab3fb2ec563ddd00a
- SHA512 c7040f9c0b16e1ece2e50d5f56740a7347a1cc0efeae7df02908b020831eb246796d20de80ece86f852775a4b9dbd084ecae70be6cb22a6fc52b037bda20e830
- SSDEEP 196608:vXZ4wdShyI6MzjTUbrooriZHLwWIcl2FVIo2Ghi3Cx6smv0:v+76MfTar5roHLARVIo2G886P
- TLSH T14486335CE044267ED595B6316DC428AEDBE28475E4438DC6AF4BCF3A081F74A2E6D331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\servbrow.exe
- Size 7.6MB
- SHA256 8ddd75521305ce78058b2375208a1c41bbdf42101c5a7266363ffb20ea187840
- MD5 6bb3464f7a67626563c1509da9f27cf4
- SHA1 baa36c2a023eefbeb74bba36e5c62585fc294f7c
- SHA512 0d47fcd0e803443b4de5c1effb109bc361359f3bc56d9f2fa5c77c60e1823976f09e132f8aa5bce4f959e90325234b6dc02a483ab47c341eb160deff4e2b9ed7
- SSDEEP 196608:PDXikTQqN1RJOBkAllg/Vo/e9ruAlrLtAs76sh4lzis+:PjADBjAgwruAJyNsmlz3+
- TLSH T1BB863342409E0919C56B0770237BCDBACA602E1495E9E94FDF241DEF502B72FE247B6E
- MD5 SHA1 SHA512 SSDEEP TLSH