Analysis
- max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/08/2026, 14:17
General
- Target 2026-08-14_158da2dfdfa76b436a80abe60d9988e4_elex_mimic_pay2key_wannacry.exe
- Size 30.9MB
- Sample260814-rlw2vsac59
- SHA256 41fe83283281ea3f80656c160ddd61f588808361da740f976c01c1d4f10b5be0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 21 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_158da2dfdfa76b436a80abe60d9988e4_elex_mimic_pay2key_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_158da2dfdfa76b436a80abe60d9988e4_elex_mimic_pay2key_wannacry.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000"3⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DOPUS\dopus.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DOPUS\dopus.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DOPUS\dopusrt.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DOPUS\dopusrt.exe" /dblclk3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CollectionMenu.dop
ContextMenu.dop
FTPMenu.dop
LibraryMenu.dop
MyComputerBackground.dop
ViewerContextMenu.dop
ZipMenu.dop
alwaysactivekeys.xml
å·²æ ‡è®°çš„å›¾ç‰‡.col
archives.oxc
colorgroups.oxc
exploreroverride.oxc
folderaliases.oxc
foldercolors.oxc
hotkeys.oxc
iconsets.oxc
images.oxc
prefs.oxc
scriptconfig.oxc
toolbars.oxc
userprefs.oxc
viewer_hotkeys.oxc
viewerplugins.oxc
virtualfolders.oxc
AllFiles.oxr
AllFilesystemObjects.oxr
Directory.oxr
Drive.oxr
groups.oxr
OpusCollectionItem.oxr
OpusPictureHandler.oxr
OpusTextHandler.oxr
OpusUnknown.oxr
OpusZip.oxr
lnkfile.oxr
default.xml
ftp.off
Cn-neoland.dll
defstylekey.xml
programdata.xml
defaultkey.xml
shellcolumns.osd.tmp
audiotags.dll
dcrawrap.dll
docs.dll
gifanim.dll
j2k.dll
movie.dll
multiview.dll
opuswic.dll
pcx.dll
wma.dll
dopus.cert
dopus.exe
dopuslib.dll
userdata.omd
memory/2296-377-0x00007FFBE9A80000-0x00007FFBE9A81000-memory.dmp
memory/2296-376-0x00007FFBE9A70000-0x00007FFBE9A71000-memory.dmp
memory/2296-438-0x00007FFBE4A00000-0x00007FFBE4A01000-memory.dmp
memory/2296-439-0x00007FFBE8AE0000-0x00007FFBE8AE1000-memory.dmp