Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe
- Size 698KB
- Sample260809-g4lczaap51
- SHA256 891656dde5394236f6834f7c7cecdd872dccc2b81671a094480c3646f93e2b4f
- MD5 f58d15227a556e72668aa0d435662e1d
- SHA1 8a5a238fb09a7820dad6e81cb5add8b428cca44e
- SHA512 799b4b0e957244b76e4dbaeb392199b28c45ca675e4b00433326c2c3c3eac0858a2360a40f511d27f300482b133bf63cd3402df87b8f907c2762305898aaa9c8
- SSDEEP 6144:+T1tT4DtLUjD5xszhRHPxL9es0mPH+WSgE43SoRUJDJG:+T1tTyUjD5xszt9euP+b0SoRUJDJG
- TLSH T1E2E4E742B780E923D96E4A3068F9C76A2B31FCC63F4287472315B3DC5E72351AA6525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\USR_Shohdi_Photo_USR.rsu 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification C:\Windows\SysWOW64\USR_Shohdi_Photo_USR.rsu 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\EXCEL.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.usr 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\USR_Shohdi_Photo_USR.exe 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f58d15227a556e72668aa0d435662e1d_cloudeye_elex_hijackloader_shodi_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\USR_Shohdi_Photo_USR.rsu
- Size 698KB
- SHA256 891656dde5394236f6834f7c7cecdd872dccc2b81671a094480c3646f93e2b4f
- MD5 f58d15227a556e72668aa0d435662e1d
- SHA1 8a5a238fb09a7820dad6e81cb5add8b428cca44e
- SHA512 799b4b0e957244b76e4dbaeb392199b28c45ca675e4b00433326c2c3c3eac0858a2360a40f511d27f300482b133bf63cd3402df87b8f907c2762305898aaa9c8
- SSDEEP 6144:+T1tT4DtLUjD5xszhRHPxL9es0mPH+WSgE43SoRUJDJG:+T1tTyUjD5xszt9euP+b0SoRUJDJG
- TLSH T1E2E4E742B780E923D96E4A3068F9C76A2B31FCC63F4287472315B3DC5E72351AA6525F
- MD5 SHA1 SHA512 SSDEEP TLSH