866c249ae7bf5c411cb7ea0363a61142ca7231c141edb2c4af42695213731c07

General

Target
2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe
Size 98KB
Sample260813-sdps9abf59
SHA256 866c249ae7bf5c411cb7ea0363a61142ca7231c141edb2c4af42695213731c07
MD5 a87c5f585bbc2bd1bef98b22b35fee29
SHA1 fb1acba0cb44d2c5ad4861f1afc3acb1be84c34e
SHA512 32349518306ed4ba31fa3368a094be26755685eafa6040129f4195a9a06f0c1de82876935f8e4b78415829d7d4ea7a663ba0eda692ad3638597f19dd0a5bb074
SSDEEP 1536:nj2AwKrSEqxQxK+oyEIXQ7+JLIzbPhwA0r7tXneqyisP9V+kyECKyxXi:j2AwNc0AXQ7+crmA0rJQykzCKcXi
TLSH
T1F9A302C27A8785F6CC213AF0305677328A1363D56096E165BF39EC60B4FD016F939E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe

Executes dropped EXE 2 IoCs

pid	Process
2152	eidolon.exe
3944	2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe
4856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2152	4252	2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe	86
PID 4252 wrote to memory of 4800	4252	2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe	87
PID 4252 wrote to memory of 4856	4252	2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe	88
PID 4856 wrote to memory of 3944	4856	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\eidolon.exe
  "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_a87c5f585bbc2bd1bef98b22b35fee29_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 43KB
SHA256 d1641c831758ad137e7fa43344daf3a4b766b16050e9e8c7214184f70d73a7e0
MD5 bf451cb9ee823b31e167198cb7ed4f0b
SHA1 e85ae1a10cfbe3c02452377292aef9bcca1e5a03
SHA512 abd696f2c45afe16e2bb9d33e9876155875e9aca458adeff400ffba2787c139e31a7325798ee3f9bcb1f5e834d6b81950e632e6c6c0b8b91d02bc56de4b15938
SSDEEP 768:1mprMxwwXa4UfJQGgz4Hwr2LC5AMxkEsJ42r9zOzPgv:QprcwwTUSGHHAOChxYJ42BzOzM
TLSH
T179137CE666BC4503DFAB4E7AB5F5EA031D35BB870890E59A218DD1C14E933819F103AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\temp\tttbrozzz.bat
Size 598B
SHA256 8fcf9eb2c9a6697a336753529135cf8b0a3e6a0eb51ec159623763a889a77643
MD5 6ef62ae38c40cca36f13958103b0cd0d
SHA1 ed07e196b7e6cd20fa1ad3a6bbcd508af9030558
SHA512 5b9dc19273a66a78a2f00816af46322ef45bd762d6442513ca09dbde386646b5b9d45d284bd538d5c3c16627a7e9b250165da5181ce7cff6aa6a5107db42e8b6
TLSH
T194F0421097F6C5A61C55B02347AA768DD120786AAF9F2B140B68466BE5D094FBF53201
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\temp\tttdelzzz.bat
Size 313B
SHA256 d335233dddabf96c1b6b84648293970cd4cb304942c7037811ceadcda4962cfe
MD5 d87356da55f4f1f50b6d7efb2f0bb5cd
SHA1 0103f0b131f5c74b01e961384242002a0aeeb4cc
SHA512 5b7a4361672d84e0df44fd4c0377d858fbb6ab6ed3f6ea00b95e6f6d2bffd607f515b324cd016b8ff2de56f7ee959f4f53629d039e64f95805472980c33f8822
TLSH
T107E07D246FF4C9824C25702393AA36CDC11478DB1E4F17140B2D4672D5C054D7D53101
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3944-25-0x0000020AF6A00000-0x0000020AF6A0A000-memory.dmp

Download

memory/3944-26-0x0000020AF86E0000-0x0000020AF86EA000-memory.dmp

Download

memory/3944-27-0x0000020AF87F0000-0x0000020AF87F8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads