Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/08/2026, 00:50
General
- Target 2026-08-16_3b111cc985fa0aee5972bb20dd16877c_elex_wannacry.exe
- Size 612KB
- Sample260817-a6767agg63
- SHA256 4c79065e3f402b06c2aa4c1705348525a241dc1dd4e4956b782b569521da2897
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 29 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_3b111cc985fa0aee5972bb20dd16877c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_3b111cc985fa0aee5972bb20dd16877c_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
elevation_service.exe
wmpnetwk.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/696-143-0x0000016BFD580000-0x0000016BFD5E6000-memory.dmp
memory/696-142-0x00007FF7C2860000-0x00007FF7C2B84000-memory.dmp
memory/696-141-0x0000016BFD580000-0x0000016BFD5E6000-memory.dmp
memory/696-195-0x00007FF7C2860000-0x00007FF7C2B84000-memory.dmp
memory/744-169-0x000001714F2B0000-0x000001714F316000-memory.dmp
memory/744-170-0x000001714F2B0000-0x000001714F316000-memory.dmp
memory/744-175-0x000001714F2B0000-0x000001714F316000-memory.dmp
memory/744-177-0x00007FF6072B0000-0x00007FF6076D9000-memory.dmp
memory/744-171-0x00007FF6072B0000-0x00007FF6076D9000-memory.dmp
memory/788-207-0x0000024199000000-0x0000024199066000-memory.dmp
memory/788-210-0x00007FF7D1B10000-0x00007FF7D1C4B000-memory.dmp
memory/788-208-0x0000024199000000-0x0000024199066000-memory.dmp
memory/788-268-0x00007FF7D1B10000-0x00007FF7D1C4B000-memory.dmp
memory/1716-218-0x0000019E8ADB0000-0x0000019E8AE16000-memory.dmp
memory/1716-270-0x00007FF6A06F0000-0x00007FF6A0A44000-memory.dmp
memory/1716-255-0x0000019E944C0000-0x0000019E944C8000-memory.dmp
memory/1716-223-0x0000019E8BED0000-0x0000019E8BEE0000-memory.dmp
memory/1716-239-0x0000019E8C100000-0x0000019E8C110000-memory.dmp
memory/1716-217-0x0000019E8ADB0000-0x0000019E8AE16000-memory.dmp
memory/1716-219-0x00007FF6A06F0000-0x00007FF6A0A44000-memory.dmp
memory/1720-40-0x000001407E7C0000-0x000001407E826000-memory.dmp
memory/1720-42-0x00007FF6A6640000-0x00007FF6A68C8000-memory.dmp
memory/1720-35-0x000001407E7C0000-0x000001407E826000-memory.dmp
memory/1720-36-0x000001407E7C0000-0x000001407E826000-memory.dmp
memory/1720-34-0x00007FF6A6640000-0x00007FF6A68C8000-memory.dmp
memory/1888-168-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1888-105-0x0000000000890000-0x00000000008F9000-memory.dmp
memory/1888-110-0x0000000000890000-0x00000000008F9000-memory.dmp
memory/1888-104-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/2212-76-0x00007FF7F4240000-0x00007FF7F4354000-memory.dmp
memory/2212-158-0x00007FF7F4240000-0x00007FF7F4354000-memory.dmp
memory/2212-77-0x00000198FEE00000-0x00000198FEE66000-memory.dmp
memory/2212-78-0x00000198FEE00000-0x00000198FEE66000-memory.dmp
memory/2508-150-0x00007FF61E8C0000-0x00007FF61EAAF000-memory.dmp
memory/2508-151-0x0000019C1B6A0000-0x0000019C1B706000-memory.dmp
memory/2508-152-0x0000019C1B6A0000-0x0000019C1B706000-memory.dmp
memory/2508-198-0x00007FF61E8C0000-0x00007FF61EAAF000-memory.dmp
memory/2528-199-0x000001CC416D0000-0x000001CC41736000-memory.dmp
memory/2528-204-0x00007FF600AC0000-0x00007FF600FEB000-memory.dmp
memory/2528-200-0x000001CC416D0000-0x000001CC41736000-memory.dmp
memory/2528-267-0x00007FF600AC0000-0x00007FF600FEB000-memory.dmp
memory/2648-182-0x00007FF649420000-0x00007FF64988D000-memory.dmp
memory/2648-192-0x000001F898640000-0x000001F8986A6000-memory.dmp
memory/2648-126-0x000001F898640000-0x000001F8986A6000-memory.dmp
memory/2648-125-0x000001F898640000-0x000001F8986A6000-memory.dmp
memory/2648-124-0x00007FF649420000-0x00007FF64988D000-memory.dmp
memory/2648-194-0x00007FF649420000-0x00007FF64988D000-memory.dmp
memory/3772-55-0x00007FF6EB0C0000-0x00007FF6EB1A7000-memory.dmp
memory/3772-17-0x000002A8F5900000-0x000002A8F5966000-memory.dmp
memory/3772-14-0x00007FF6EB0C0000-0x00007FF6EB1A7000-memory.dmp
memory/3772-15-0x000002A8F5900000-0x000002A8F5966000-memory.dmp
memory/3824-65-0x000001C88E620000-0x000001C88E686000-memory.dmp
memory/3824-64-0x00007FF6F4360000-0x00007FF6F44C8000-memory.dmp
memory/3824-66-0x000001C88E620000-0x000001C88E686000-memory.dmp
memory/3824-71-0x000001C88E620000-0x000001C88E686000-memory.dmp
memory/3824-73-0x00007FF6F4360000-0x00007FF6F44C8000-memory.dmp
memory/3872-63-0x00007FF6360E0000-0x00007FF6361C4000-memory.dmp
memory/3872-25-0x000002D235630000-0x000002D235696000-memory.dmp
memory/3872-26-0x00007FF6360E0000-0x00007FF6361C4000-memory.dmp
memory/3872-28-0x000002D235630000-0x000002D235696000-memory.dmp
memory/3948-264-0x00007FF7AF5A0000-0x00007FF7AFA7D000-memory.dmp
memory/3948-186-0x000001723C980000-0x000001723C9E6000-memory.dmp
memory/3948-191-0x00007FF7AF5A0000-0x00007FF7AFA7D000-memory.dmp
memory/3948-187-0x000001723C980000-0x000001723C9E6000-memory.dmp
memory/4136-284-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-289-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-279-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-280-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-281-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-282-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-285-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-286-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-287-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-288-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-278-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4136-283-0x0000022611CC0000-0x0000022611CD0000-memory.dmp
memory/4140-0-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/4140-43-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/4140-6-0x00000000022B0000-0x0000000002319000-memory.dmp
memory/4140-2-0x00000000022B0000-0x0000000002319000-memory.dmp
memory/4348-178-0x00007FF7D8820000-0x00007FF7D88C8000-memory.dmp
memory/4348-118-0x0000026A68B30000-0x0000026A68B96000-memory.dmp
memory/4348-117-0x0000026A68B30000-0x0000026A68B96000-memory.dmp
memory/4348-116-0x00007FF7D8820000-0x00007FF7D88C8000-memory.dmp
memory/4404-161-0x000001BD99A70000-0x000001BD99AD6000-memory.dmp
memory/4404-209-0x00007FF6B8E00000-0x00007FF6B8F8F000-memory.dmp
memory/4404-159-0x00007FF6B8E00000-0x00007FF6B8F8F000-memory.dmp
memory/4404-160-0x000001BD99A70000-0x000001BD99AD6000-memory.dmp
memory/4648-56-0x00000229BF4F0000-0x00000229BF556000-memory.dmp
memory/4648-54-0x00000229BF2D0000-0x00000229BF3CA000-memory.dmp
memory/4648-57-0x00000229BF4F0000-0x00000229BF556000-memory.dmp
memory/4752-47-0x000001730D930000-0x000001730D996000-memory.dmp
memory/4752-46-0x000001730D710000-0x000001730D80A000-memory.dmp
memory/4752-48-0x000001730D930000-0x000001730D996000-memory.dmp
memory/4840-135-0x000001AB396B0000-0x000001AB39716000-memory.dmp
memory/4840-185-0x00007FF6CC230000-0x00007FF6CC2DB000-memory.dmp
memory/4840-133-0x00007FF6CC230000-0x00007FF6CC2DB000-memory.dmp
memory/4840-134-0x000001AB396B0000-0x000001AB39716000-memory.dmp
memory/4888-96-0x00007FF6CD610000-0x00007FF6CD6FA000-memory.dmp
memory/4888-97-0x00000202CBBE0000-0x00000202CBC46000-memory.dmp
memory/4888-165-0x00007FF6CD610000-0x00007FF6CD6FA000-memory.dmp
memory/4888-99-0x00000202CBBE0000-0x00000202CBC46000-memory.dmp
memory/5020-89-0x00000196069D0000-0x0000019606A36000-memory.dmp
memory/5020-88-0x00000196067B0000-0x00000196068AA000-memory.dmp
memory/5020-90-0x00000196069D0000-0x0000019606A36000-memory.dmp
memory/5052-181-0x00007FF787300000-0x00007FF7875BE000-memory.dmp
memory/5052-260-0x00007FF787300000-0x00007FF7875BE000-memory.dmp