fb718c4ea631f773077522073fc326fefdda5e62fff71b2af50cc7bab99fb037

General

Target
2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe
Size 86KB
Sample260809-lnmnbavdqg
SHA256 fb718c4ea631f773077522073fc326fefdda5e62fff71b2af50cc7bab99fb037
MD5 fa9265d0d203c4ddf7f8871cf43edf07
SHA1 8e3bde8861985106be35c448dbdc753a5bffc9be
SHA512 22be67a8d8ebd190907d483ba0469884ca5ccf9d8b233ec900369bc41e86992e282cfa6eb039fb879dbd60b09a20fb4224a117ee18627369d5d7f9862ea4e36f
SSDEEP 1536:TSSABNx6vb4RoI47zzzzzzzzzvfxzVzNrzzzgzzzzzzzzzzzzzzzz6zzzdzzzzlA:eSABNx6vb4RoI4pyjHYLhal01UoPX8
TLSH
T1E7839C0BABA958E9E1206870152D373597EF986F3B2597A38384FE4D9133DC1EC3614E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6112	jnrvc.exe

Executes dropped EXE 1 IoCs

pid	Process
6112	jnrvc.exe

Loads dropped DLL 1 IoCs

pid	Process
4516	rundll32.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3324	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	4516	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnrvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5948	PING.EXE
3324	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5948	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3852	2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe
6112	jnrvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3324	3852	2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe	89
PID 3324 wrote to memory of 5948	3324	cmd.exe	91
PID 3324 wrote to memory of 6112	3324	cmd.exe	92
PID 6112 wrote to memory of 4516	6112	jnrvc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&c:\jnrvc.exe "C:\Users\Admin\AppData\Local\Temp\2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5948
- - \??\c:\jnrvc.exe
    c:\jnrvc.exe "C:\Users\Admin\AppData\Local\Temp\2026-08-09_fa9265d0d203c4ddf7f8871cf43edf07_elex_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\odvva\qgtwn.dll",DoVirusScan c:\jnrvc.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 492
        5⤵
        Program crash
        
        PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4516 -ip 4516
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jnrvc.exe

Path \??\c:\jnrvc.exe
Size 86KB
SHA256 f6a903f3198da3317db98eca2894aee386aa7c9d98f1b5e773c292048b274050
MD5 ba6354e4f94748b65dddb3071ad67c83
SHA1 255b4b6077b4e25c16ae51412b3697301734b2d7
SHA512 9b3bfe04568a2550c588f4d6f44a93e2caebd6b1edabc9fc088bdeefacfc70437f73779b321a95cf1bbb3907940d09d94ddcc8a7fc35b437bca0062fe5ef726d
SSDEEP 1536:TSSABNx6vb4RoI47zzzzzzzzzvfxzVzNrzzzgzzzzzzzzzzzzzzzz6zzzdzzzzlY:eSABNx6vb4RoI4pyjHYLhal01UoPXE
TLSH
T14C838C07ABA958E9E1206870162D373597EF986F3B2597A38384FE4D9133DC1EC3614E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgtwn.dll

Path \??\c:\odvva\qgtwn.dll
Size 50KB
SHA256 7604a0d3e695ff2f47b2961a860aa77e41952df48c132c18ac8d84e6ed3ee8eb
MD5 18cc91cc0c4c41e39a2c5310e760f0ef
SHA1 aaacc94db8d8a37e5d34878aa259d3274a5ff2a7
SHA512 8abba5220a7216288d0d2c683a5d01b796b1179464a2432eda991004348223c822c54ab39fd19302ff01974ec8d026e98280e9f1bdb67178126d75a974ecc7e7
SSDEEP 768:Z+arYIR3u5v4bGwCl56LNQQe5JBtGf1oTYtx/qQvo9:ZPrG57TzDxJS6Etx/ZvO
TLSH
T1AB33E178E1F4B8F6E46EAB345D82146DB1C16BD34D3080BA079224AF6C37E578B52731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3852-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3852-2-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4516-9-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/6112-6-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads