Analysis
- max time kernel
147s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 17:51
General
- Target 2026-08-20_589c076da3dc21d13b2f9c598161b43d_elex_wannacry.exe
- Size 612KB
- Sample260820-wfe9dawsat
- SHA256 96aee7b7820a9d87f03ce804b17ba6980339783f038141c22fb17afd53e75e6e
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_589c076da3dc21d13b2f9c598161b43d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_589c076da3dc21d13b2f9c598161b43d_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2896 2892 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2888 2924 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2896 2892 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2888 2924 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/200-447-0x0000029B005D0000-0x0000029B00C50000-memory.dmp
memory/200-335-0x0000029B005D0000-0x0000029B00C50000-memory.dmp
memory/704-36-0x000001C4A7A30000-0x000001C4A7A96000-memory.dmp
memory/704-38-0x000001C4A7A30000-0x000001C4A7A96000-memory.dmp
memory/704-87-0x00007FF69A190000-0x00007FF69A258000-memory.dmp
memory/704-39-0x000001C4A7A30000-0x000001C4A7A96000-memory.dmp
memory/704-35-0x00007FF69A190000-0x00007FF69A258000-memory.dmp
memory/1252-126-0x000001E132CC0000-0x000001E132D26000-memory.dmp
memory/1252-200-0x00007FF6DFFF0000-0x00007FF6E009D000-memory.dmp
memory/1252-127-0x000001E132CC0000-0x000001E132D26000-memory.dmp
memory/1252-125-0x00007FF6DFFF0000-0x00007FF6E009D000-memory.dmp
memory/1708-56-0x0000021E23870000-0x0000021E238D6000-memory.dmp
memory/1708-55-0x0000021E23870000-0x0000021E238D6000-memory.dmp
memory/1708-54-0x0000021E235F0000-0x0000021E23749000-memory.dmp
memory/2748-170-0x00007FF7F6CA0000-0x00007FF7F6FC0000-memory.dmp
memory/2748-178-0x00007FF7F6CA0000-0x00007FF7F6FC0000-memory.dmp
memory/2748-176-0x00000254BF3B0000-0x00000254BF416000-memory.dmp
memory/2748-171-0x00000254BF3B0000-0x00000254BF416000-memory.dmp
memory/2748-172-0x00000254BF3B0000-0x00000254BF416000-memory.dmp
memory/2824-251-0x000001C87A9F0000-0x000001C87AC8E000-memory.dmp
memory/2824-252-0x00007FF7204A0000-0x00007FF7207DE000-memory.dmp
memory/2824-223-0x00007FF7204A0000-0x00007FF7207DE000-memory.dmp
memory/2824-222-0x000001C878680000-0x000001C8786E6000-memory.dmp
memory/2824-224-0x000001C878680000-0x000001C8786E6000-memory.dmp
memory/2960-181-0x00007FF739410000-0x00007FF739559000-memory.dmp
memory/2960-96-0x00007FF739410000-0x00007FF739559000-memory.dmp
memory/2960-99-0x0000019C07FF0000-0x0000019C08056000-memory.dmp
memory/2960-98-0x0000019C07FF0000-0x0000019C08056000-memory.dmp
memory/3176-28-0x00000219F2B00000-0x00000219F2B66000-memory.dmp
memory/3176-26-0x00007FF69A190000-0x00007FF69A258000-memory.dmp
memory/3176-27-0x00000219F2B00000-0x00000219F2B66000-memory.dmp
memory/3176-29-0x00000219F2B00000-0x00000219F2B66000-memory.dmp
memory/3176-62-0x00007FF69A190000-0x00007FF69A258000-memory.dmp
memory/3264-191-0x00007FF69AB50000-0x00007FF69B020000-memory.dmp
memory/3264-248-0x00007FF69AB50000-0x00007FF69B020000-memory.dmp
memory/3264-193-0x000002266A140000-0x000002266A1A6000-memory.dmp
memory/3264-192-0x000002266A140000-0x000002266A1A6000-memory.dmp
memory/3268-240-0x0000013537FB0000-0x0000013538016000-memory.dmp
memory/3268-242-0x00007FF7BE0A0000-0x00007FF7BE4B6000-memory.dmp
memory/3268-207-0x00007FF7BE0A0000-0x00007FF7BE4B6000-memory.dmp
memory/3268-134-0x00007FF7BE0A0000-0x00007FF7BE4B6000-memory.dmp
memory/3268-135-0x0000013537FB0000-0x0000013538016000-memory.dmp
memory/3268-136-0x0000013537FB0000-0x0000013538016000-memory.dmp
memory/3364-64-0x0000012EB6AA0000-0x0000012EB6B06000-memory.dmp
memory/3364-72-0x00007FF716F40000-0x00007FF7170A8000-memory.dmp
memory/3364-65-0x0000012EB6AA0000-0x0000012EB6B06000-memory.dmp
memory/3364-63-0x00007FF716F40000-0x00007FF7170A8000-memory.dmp
memory/3364-70-0x0000012EB6AA0000-0x0000012EB6B06000-memory.dmp
memory/3772-162-0x00007FF6EEA10000-0x00007FF6EEBA4000-memory.dmp
memory/3772-236-0x00007FF6EEA10000-0x00007FF6EEBA4000-memory.dmp
memory/3772-164-0x00000177D6970000-0x00000177D69D6000-memory.dmp
memory/3772-163-0x00000177D6970000-0x00000177D69D6000-memory.dmp
memory/4560-37-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/4560-0-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/4560-1-0x0000000002460000-0x00000000024C9000-memory.dmp
memory/4560-6-0x0000000002460000-0x00000000024C9000-memory.dmp
memory/4560-8-0x0000000002460000-0x00000000024C9000-memory.dmp
memory/4792-189-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4792-111-0x0000000000820000-0x0000000000889000-memory.dmp
memory/4792-106-0x0000000000820000-0x0000000000889000-memory.dmp
memory/4792-105-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4820-18-0x0000025F0F990000-0x0000025F0F9F6000-memory.dmp
memory/4820-15-0x00007FF6A71C0000-0x00007FF6A72E2000-memory.dmp
memory/4820-17-0x0000025F0F990000-0x0000025F0F9F6000-memory.dmp
memory/4820-16-0x0000025F0F990000-0x0000025F0F9F6000-memory.dmp
memory/4820-51-0x00007FF6A71C0000-0x00007FF6A72E2000-memory.dmp
memory/4908-88-0x000001CF27560000-0x000001CF276B9000-memory.dmp
memory/4908-89-0x000001CF276C0000-0x000001CF27726000-memory.dmp
memory/4908-90-0x000001CF276C0000-0x000001CF27726000-memory.dmp
memory/4952-221-0x00007FF698380000-0x00007FF698623000-memory.dmp
memory/4952-154-0x0000022D604A0000-0x0000022D60506000-memory.dmp
memory/4952-153-0x00007FF698380000-0x00007FF698623000-memory.dmp
memory/4952-155-0x0000022D604A0000-0x0000022D60506000-memory.dmp
memory/5208-184-0x00000281C2F40000-0x00000281C2FA6000-memory.dmp
memory/5208-183-0x00000281C2F40000-0x00000281C2FA6000-memory.dmp
memory/5208-182-0x00007FF632DC0000-0x00007FF63304A000-memory.dmp
memory/5208-245-0x00007FF632DC0000-0x00007FF63304A000-memory.dmp
memory/5340-47-0x000001FDA6E50000-0x000001FDA6EB6000-memory.dmp
memory/5340-45-0x000001FDA6C20000-0x000001FDA6D79000-memory.dmp
memory/5340-46-0x000001FDA6E50000-0x000001FDA6EB6000-memory.dmp
memory/5356-202-0x000001F1982A0000-0x000001F198306000-memory.dmp
memory/5356-249-0x00007FF68D6F0000-0x00007FF68DBF6000-memory.dmp
memory/5356-203-0x000001F1982A0000-0x000001F198306000-memory.dmp
memory/5356-201-0x00007FF68D6F0000-0x00007FF68DBF6000-memory.dmp
memory/5380-211-0x00007FF693560000-0x00007FF693613000-memory.dmp
memory/5380-144-0x00007FF693560000-0x00007FF693613000-memory.dmp
memory/5380-146-0x000002093A270000-0x000002093A2D6000-memory.dmp
memory/5380-145-0x000002093A270000-0x000002093A2D6000-memory.dmp
memory/5576-75-0x00007FF76E2F0000-0x00007FF76E409000-memory.dmp
memory/5576-161-0x00007FF76E2F0000-0x00007FF76E409000-memory.dmp
memory/5576-77-0x000001CC0D7E0000-0x000001CC0D846000-memory.dmp
memory/5576-76-0x000001CC0D7E0000-0x000001CC0D846000-memory.dmp
memory/5668-213-0x000001FD674C0000-0x000001FD67526000-memory.dmp
memory/5668-214-0x000001FD674C0000-0x000001FD67526000-memory.dmp
memory/5668-250-0x00007FF64EE20000-0x00007FF64EF4E000-memory.dmp
memory/5668-212-0x00007FF64EE20000-0x00007FF64EF4E000-memory.dmp
memory/6128-117-0x00007FF791110000-0x00007FF791853000-memory.dmp
memory/6128-197-0x00007FF791110000-0x00007FF791853000-memory.dmp
memory/6128-261-0x000001993EC80000-0x000001993ECE6000-memory.dmp
memory/6128-263-0x00007FF791110000-0x00007FF791853000-memory.dmp
memory/6128-118-0x000001993EC80000-0x000001993ECE6000-memory.dmp
memory/6128-119-0x000001993EC80000-0x000001993ECE6000-memory.dmp