Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 09:00
General
- Target 2026-08-09_f83457823e1211a355c36df794c2f48f_elex_wannacry.exe
- Size 20.1MB
- Sample260809-kylnbsthpe
- SHA256 7d6fc4b08d23d16c064cc86ddb58ffa49b744a4a5eac6e9743b8ac92388e5ecf
Malware Config
Signatures
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Modifies system certificate store 2 TTPs 9 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 31 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_f83457823e1211a355c36df794c2f48f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f83457823e1211a355c36df794c2f48f_elex_wannacry.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\Integrator.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\Integrator.exe" /portable2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\RegistryCleaner.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\RegistryCleaner.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\TabReports.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\TabReports.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\TabCareCenter.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\TabCareCenter.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\ActionCenter.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F0AE938\ActionCenter.exe" /portable3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ActionCenterHelper.dll
AxComponentsRTL.bpl
AxComponentsVCL.bpl
CFAHelper.dll
CommonForms.Routine.dll
CommonForms.Site.dll
main.ini
DebugHelper.dll
GoogleAnalyticsHelper.dll
Integrator.exe
enu.lng
Localizer.dll
RegistryCleaner.exe
RescueCenterForm.dll
RescueCenterHelper.dll
StyleManagerHelper.dll
TabReports.exe
TaskSchedulerHelper.dll
rtl250.bpl
vcl250.bpl
vclimg250.bpl
memory/1896-142-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-103-0x0000000000F50000-0x000000000183B000-memory.dmp
memory/1896-154-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-119-0x0000000000F50000-0x000000000183B000-memory.dmp
memory/1896-121-0x00000000018A0000-0x00000000022C6000-memory.dmp
memory/1896-166-0x0000000007560000-0x0000000007580000-memory.dmp
memory/1896-165-0x0000000007560000-0x0000000007580000-memory.dmp
memory/1896-204-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-206-0x0000000007F00000-0x0000000007F20000-memory.dmp
memory/1896-120-0x0000000001840000-0x000000000189A000-memory.dmp
memory/1896-226-0x00000000082A0000-0x000000000832B000-memory.dmp
memory/1896-117-0x0000000050000000-0x00000000502AD000-memory.dmp
memory/1896-116-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-218-0x0000000007FB0000-0x0000000007FD5000-memory.dmp
memory/1896-113-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-222-0x0000000008010000-0x000000000829B000-memory.dmp
memory/1896-205-0x0000000007F00000-0x0000000007F20000-memory.dmp
memory/1896-203-0x0000000007DF0000-0x0000000007EF8000-memory.dmp
memory/1896-192-0x0000000007660000-0x0000000007680000-memory.dmp
memory/1896-191-0x0000000007660000-0x0000000007680000-memory.dmp
memory/1896-190-0x0000000007BE0000-0x0000000007C39000-memory.dmp
memory/1896-187-0x0000000007B30000-0x0000000007BDD000-memory.dmp
memory/1896-112-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-183-0x0000000007640000-0x000000000765B000-memory.dmp
memory/1896-111-0x00000000005E0000-0x00000000005E5000-memory.dmp
memory/1896-110-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-178-0x0000000007580000-0x00000000075B2000-memory.dmp
memory/1896-109-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-230-0x0000000008350000-0x00000000083D9000-memory.dmp
memory/1896-105-0x0000000001840000-0x000000000189A000-memory.dmp
memory/1896-234-0x000000000AE10000-0x000000000B04F000-memory.dmp
memory/1896-236-0x000000000B190000-0x000000000B1B0000-memory.dmp
memory/1896-235-0x000000000B190000-0x000000000B1B0000-memory.dmp
memory/1896-248-0x0000000007460000-0x00000000074BC000-memory.dmp
memory/1896-107-0x00000000018A0000-0x00000000022C6000-memory.dmp
memory/1896-602-0x0000000000400000-0x0000000000987000-memory.dmp
memory/1896-118-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/2480-359-0x0000000006AC0000-0x0000000006AE0000-memory.dmp
memory/2480-369-0x0000000006B60000-0x0000000006C68000-memory.dmp
memory/2480-311-0x0000000005EE0000-0x0000000005F00000-memory.dmp
memory/2480-312-0x0000000005EE0000-0x0000000005F00000-memory.dmp
memory/2480-357-0x0000000006860000-0x0000000006892000-memory.dmp
memory/2480-278-0x0000000000C00000-0x0000000001626000-memory.dmp
memory/2480-277-0x0000000000680000-0x00000000006DA000-memory.dmp
memory/2480-276-0x0000000000950000-0x0000000000BFD000-memory.dmp
memory/2480-381-0x0000000006E90000-0x000000000711B000-memory.dmp
memory/2480-358-0x0000000006A60000-0x0000000006AB9000-memory.dmp
memory/2480-360-0x0000000006AC0000-0x0000000006AE0000-memory.dmp
memory/2480-370-0x0000000006DB0000-0x0000000006DD0000-memory.dmp
memory/2480-371-0x0000000006DB0000-0x0000000006DD0000-memory.dmp
memory/2480-380-0x0000000006E60000-0x0000000006E85000-memory.dmp
memory/3748-280-0x00000000009A0000-0x0000000000C4D000-memory.dmp
memory/3748-282-0x0000000000C50000-0x0000000001676000-memory.dmp
memory/3748-281-0x0000000000830000-0x000000000088A000-memory.dmp
memory/4872-383-0x0000000007370000-0x0000000007554000-memory.dmp
memory/4872-267-0x0000000000860000-0x00000000008BA000-memory.dmp
memory/4872-382-0x00000000070B0000-0x000000000715D000-memory.dmp
memory/4872-310-0x0000000006C70000-0x0000000006EFB000-memory.dmp
memory/4872-265-0x0000000000A20000-0x0000000000CCD000-memory.dmp
memory/4872-289-0x0000000005FF0000-0x0000000006010000-memory.dmp
memory/4872-269-0x0000000000CD0000-0x00000000016F6000-memory.dmp
memory/4872-288-0x0000000005FF0000-0x0000000006010000-memory.dmp
memory/4872-298-0x0000000006970000-0x00000000069A2000-memory.dmp
memory/4872-301-0x0000000006BD0000-0x0000000006BF0000-memory.dmp
memory/4872-300-0x0000000006BD0000-0x0000000006BF0000-memory.dmp
memory/4872-422-0x00000000076A0000-0x000000000787E000-memory.dmp
memory/4872-299-0x0000000006B70000-0x0000000006BC9000-memory.dmp
memory/4916-286-0x0000000000BE0000-0x0000000001606000-memory.dmp
memory/4916-284-0x0000000000930000-0x0000000000BDD000-memory.dmp