85be956e44db87f9b0b7531404235e7479e2621b6147980bc29fe2602a12d764

Analysis

max time kernel
75s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe
Size 1.7MB
Sample260814-xtytbazzbt
SHA256 85be956e44db87f9b0b7531404235e7479e2621b6147980bc29fe2602a12d764
MD5 a23207354aa9957390d8670219e38940
SHA1 0e7d2b4d55da998305554e66aeaa14acd102f8e2
SHA512 b4a382c69900311fd99c9afa281fed29d0cb54178c863ae68e205b7e645b1a1a0857d8b29021891b4166f0cf7c16e16dc9c8bda1a0a6d5f727ce047b6a2a1a36
SSDEEP 24576:tudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:tBYH2afPAgkMcxNU
TLSH
T1A1855C15B29A41F1CE45A87028EEF7FE66749B890B1A9FC3A318DE3C55723D2A43711C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery installer persistence

Malware Config

Signatures

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/4380-36-0x000001E025B30000-0x000001E025B32000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Downloads MZ/PE file 2 IoCs

flow	pid	Process
11	4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe
10	4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe

Executes dropped EXE 6 IoCs

pid	Process
1876	svchlp3.exe
5124	svchlp3.exe
264	svchlp4.exe
1136	svchlp4.tmp
1540	svchlp5.exe
4544	wlrmdr.exe

Loads dropped DLL 1 IoCs

pid	Process
1136	svchlp4.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchlp3.exe"	svchlp3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchlp3.exe"	svchlp3.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1876 set thread context of 4380	1876	svchlp3.exe	59
PID 5124 set thread context of 4380	5124	svchlp3.exe	59

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchlp4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchlp4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c581-17.dat	innosetup
behavioral2/memory/264-20-0x0000000000BB0000-0x0000000000CB6000-memory.dmp	innosetup
behavioral2/memory/264-61-0x0000000000BB0000-0x0000000000CB6000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1876	svchlp3.exe
1876	svchlp3.exe
1876	svchlp3.exe
1876	svchlp3.exe
5124	svchlp3.exe
5124	svchlp3.exe
5124	svchlp3.exe
5124	svchlp3.exe
1540	svchlp5.exe
1540	svchlp5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1124	explorer.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe
Token: SeShutdownPrivilege	1124	explorer.exe
Token: SeCreatePagefilePrivilege	1124	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe
4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe
6124	Conhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1876	4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe	90
PID 1876 wrote to memory of 4380	1876	svchlp3.exe	59
PID 5124 wrote to memory of 4380	5124	svchlp3.exe	59
PID 4632 wrote to memory of 264	4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe	93
PID 264 wrote to memory of 1136	264	svchlp4.exe	94
PID 4632 wrote to memory of 1540	4632	2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe	95
PID 1540 wrote to memory of 4380	1540	svchlp5.exe	59
PID 1540 wrote to memory of 4416	1540	svchlp5.exe	60
PID 1540 wrote to memory of 4984	1540	svchlp5.exe	64
PID 1540 wrote to memory of 5136	1540	svchlp5.exe	66
PID 1540 wrote to memory of 5028	1540	svchlp5.exe	80
PID 1540 wrote to memory of 1124	1540	svchlp5.exe	81
PID 1540 wrote to memory of 2584	1540	svchlp5.exe
PID 1540 wrote to memory of 6124	1540	svchlp5.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4416

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000260;000000000000026C;
1⤵
PID:4984

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5136

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5028
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_a23207354aa9957390d8670219e38940_elex_wannacry.exe"
    3⤵
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\is-72K373OF07.tmp\svchlp4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-72K373OF07.tmp\svchlp4.tmp" /SL5="$500AE,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\svchlp4.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
      C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1540

C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5124

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:6124

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchlp4.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-72K373OF07.tmp\svchlp4.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-P33YVWBVPQ.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp3.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp4.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp5.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
Size 54KB
SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
MD5 3e88f1a1f48cb2a3556fdac9de4e8ef9
SHA1 dd839cd4619e104298bb2d823f4678504f148622
SHA512 fe55272561838a1cc3ed5d4145c7e4c7a1418d3c1bfd92f5bc8dfa29b1f7e7417ab6e3635ed8f249277c0be3a24be09bfa4f3065c81390624b0a65fdcc3fde0f
SSDEEP 1536:vtW4y8UFRx6GbgCSUMH18htq5Hk9Uepxc6kRdps:1W4yKBHmhg5HSUep3
TLSH
T15F43092916F64B65E8728279EAB44327D0F87C46BC70421F0773CE592F938C1A67CB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-61-0x0000000000BB0000-0x0000000000CB6000-memory.dmp

Download

memory/264-20-0x0000000000BB0000-0x0000000000CB6000-memory.dmp

Download

memory/1124-60-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/1136-69-0x0000000000CF0000-0x0000000001150000-memory.dmp

Download

memory/1136-75-0x0000000000CF0000-0x0000000001150000-memory.dmp

Download

memory/1136-62-0x0000000000CF0000-0x0000000001150000-memory.dmp

Download

memory/1136-71-0x0000000000CF0000-0x0000000001150000-memory.dmp

Download

memory/1136-67-0x0000000000CF0000-0x0000000001150000-memory.dmp

Download

memory/4380-10-0x000001E026FA0000-0x000001E026FD2000-memory.dmp

Download

memory/4380-47-0x000001E027050000-0x000001E027081000-memory.dmp

Download

memory/4380-36-0x000001E025B30000-0x000001E025B32000-memory.dmp

Download

memory/4632-0-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/4632-1-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/4984-40-0x0000000180000000-0x0000000180005000-memory.dmp

Download