c51d0227e19a47b7faff9335382e48e5f454f9c52acaec3631d437e9f0fc9bd1

General

Target
2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe
Size 72KB
Sample260821-e7313shf59
SHA256 c51d0227e19a47b7faff9335382e48e5f454f9c52acaec3631d437e9f0fc9bd1
MD5 51b24aff087f678dfebd35adc45a6928
SHA1 cb7f29e20adf75c9f5295d642160719c8f8df6bd
SHA512 7d7aff56ecfde01be17c55c9d84010a79ebbc7b09df36ffc388bf7934a0eead5e90dc0c62a82d6847d80d0f4e8305443c4e899d6be8076797fe4df3e8f1a2361
SSDEEP 1536:7m1n4CrSuwb273hhEiA+pk8oJGap7tED3NiNTp4BJdKNJ3leem:C1n4/IIUS9HF2D3NiNTmJIT0R
TLSH
T15B73F197BFA288F1D960163539C77B738A22B1EA1001F675EB25FC6294D52B0D81CE0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.bat	sqlserver.exe

Executes dropped EXE 2 IoCs

pid	Process
3308	sqlserver.exe
3260	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dumpkernel.exe	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2520	cmd.exe
1428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sqlserver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sqlserver.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3308	4004	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe	85
PID 4004 wrote to memory of 2520	4004	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe	86
PID 4004 wrote to memory of 1428	4004	2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe	88
PID 1428 wrote to memory of 3260	1428	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\temp\sqlserver.exe
  "C:\Windows\temp\sqlserver.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Local\Temp\2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_51b24aff087f678dfebd35adc45a6928_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlserver.exe

Path C:\Windows\Temp\sqlserver.exe
Size 15KB
SHA256 23fea8b183632f91e5a4d1d6a43283846c734eee820eb2084ad428b7cbe92d53
MD5 c83a01f25ea0e1c9200c5893aa2d2199
SHA1 d0c53a1aaf2be6aec7b0f73e767b62fffb010f08
SHA512 3961ce6f4e8871a5032fc5616e057e15892d846270d572f156aebd5557b72cf5dd0139e87306073243b366851e6db09b83f41294a8230836597c2c840e2704d7
SSDEEP 384:y4Od9Q2hJy5g75oOuHh7parHdAI0ptTvzTn:y4aQ2hJyjOuHhntzz
TLSH
T1D3623D5A79479F43C594C0B12B68AB38E7B9B4773D188053D740CE483E7F8819529F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 26KB
SHA256 206c2d4eddce23152082a79f0186726131241afa795db86ea9632db6212aa2ab
MD5 d9d30d5c645403fb926c8e953c3b661b
SHA1 85f430c81a465cf171ca753a71d57bc6e69fa76c
SHA512 2452f19966e15877ed9718e1349aaa297f4ef92216726e0cdc5498fabcf6a6ea7f2c2a40a41dfc4de22ec6ff0a84506cf7c325c474e141cc8b36128aa3af4068
SSDEEP 768:qctYpnrO/DK97bxcB3tNNK2LCQAHG94EQwo:7tYpnrO/Dg7SBdT3CQ995
TLSH
T155C2E15755402C24CC5C22314243ADD0BEE23B4DC9E36AA240D40EAFFE55EA6FE397DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\temp\tttbrozzz.bat
Size 582B
SHA256 49e0fbbcda2deeecef87159bfe18342c8a2a837e1158982d96616a453c3a0d4b
MD5 b7f02d5cc11de7a7e67c6a86d71fa5a1
SHA1 7f341463bddbc8ce7a0287b20093a9922c1d1d01
SHA512 ddc353dd619b026b17262514790cbf999f56a02e074ece1d01474d1b377b2d6d4cdef2a57ff204335247a42587fcf094c14c7f4a65faaaa8d16223c34f062391
TLSH
T12DF02810C2FEC7B6A861E4160796551EA314F66BAF5567180F224D89E88040BFEE3643
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\temp\tttdelzzz.bat
Size 313B
SHA256 7064f3f8f776e4bf33cf9a0aa8d687e4cfe05e4b7e19d5a22822c8901352d319
MD5 aadfb847aa8df72fb01b19c576aa6281
SHA1 33ed6439daab55f9a4560ddcc5f35bde9ef5f28e
SHA512 8881158b89b647961e0996948459cabcefa22afca675cb5306bfb7bc3eb675cbcf6e67bbfcf1a121212056b9fb1c18e160bee7ea9bbb53fa22db57642fa0a4b4
TLSH
T134E02624D6FC8797E831E01643D2050A9608F7AB2E46534D1F234CD4D88000EECD2542
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3260-24-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3260-25-0x0000000000400000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads