05db6613c5cc9047dc93a25d50c8681c19ade559eba02caaeee1e4870b4e237a

General

Target
2026-08-21_9f77361c1a59cb53ff79709decf4421b_elex_wannacry.exe
Size 5.1MB
Sample260822-k9c6bsxtdv
SHA256 05db6613c5cc9047dc93a25d50c8681c19ade559eba02caaeee1e4870b4e237a
MD5 9f77361c1a59cb53ff79709decf4421b
SHA1 f60efb6e0757581c7c55d59cb9e84059d747af5a
SHA512 0b28b826eba50cedd9d856387bb033544eb34d16abb9a968225c4bca01167942f1f7ff9277020e2eb9e21762bf4113e8b56a8a3ecb56f051804ee9143b4802a5
SSDEEP 98304:5er6uFFkOuPd2y+FA9ChDd5A6+ndGaX6tJJQv2FKA75OpVclc02vDRZTEH:8r6uFFkOuPd2yHsDY6wo3u0jc02vVZoH
TLSH
T13536239296017276E41E9DFC566CC7B6EE237DEDA9482C42018EF1ABB0FD0214D94DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Executes dropped EXE 6 IoCs

pid	Process
4904	nemu-downloader.exe
4824	ColaBoxChecker.exe
4640	HyperVChecker.exe
4228	WinRing0x64.sys
4180	HyperVChecker.exe
1544	HyperVChecker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_9f77361c1a59cb53ff79709decf4421b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4904	nemu-downloader.exe
4904	nemu-downloader.exe
4904	nemu-downloader.exe
4904	nemu-downloader.exe
4904	nemu-downloader.exe
4904	nemu-downloader.exe
4904	nemu-downloader.exe
4904	nemu-downloader.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4904	2768	2026-08-21_9f77361c1a59cb53ff79709decf4421b_elex_wannacry.exe	89
PID 4904 wrote to memory of 4824	4904	nemu-downloader.exe	90
PID 4904 wrote to memory of 4640	4904	nemu-downloader.exe	93
PID 4904 wrote to memory of 4180	4904	nemu-downloader.exe	97
PID 4904 wrote to memory of 1544	4904	nemu-downloader.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-21_9f77361c1a59cb53ff79709decf4421b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_9f77361c1a59cb53ff79709decf4421b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\nemu-downloader.exe
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1544

C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\WinRing0x64.sys
C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\WinRing0x64.sys
1⤵
- Executes dropped EXE
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\ColaBoxChecker.exe
Size 4.0MB
SHA256 1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752
MD5 839708e3f96cf055436fa08d6205263c
SHA1 a4579f8cb6b80fe3fd50099794f63eb51be3292f
SHA512 ece67e031e06a0442d935e7d81d0eed57ae92b348b5d104423577478ce226e4a4bde834c54e31d33bfe6f574fb7798ba96886d9e8edb738edee6e7c9c43054cd
SSDEEP 49152:VgP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOL:2P8dFuudB0gFLQ2QOQ660TpN1eX3d9
TLSH
T18F167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\HyperVChecker.exe
Size 117KB
SHA256 9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39
MD5 dbd84c6083e4badf4741d95ba3c9b5f8
SHA1 4a555adf8e0459bfd1145d9bd8d91b3fff94aad0
SHA512 fb5fe74f64254609e07d6642acf904562bb905cd7c14c6f85ba31bcdbaf06686c0586609ec4f5d2f8f55ff90334dcbb774a3a6e78df74bf1b1d0cd03dec21870
SSDEEP 3072:BwLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+Wy9sxtb:gn2WoLP++J8Upo+Wy9Q
TLSH
T189C37D57B3A434F5F17B8638C4950A49DB72B8320B609FAF03A842961F637D25D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRing0x64.sys

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\WinRing0x64.sys
Size 32KB
SHA256 d5bca2ca464a6cc91344bd85e812a7bac6e7c67038c4929a29e0bc60c7eabe4d
MD5 1c57d067b9fc5e9ef9aeb14223481243
SHA1 4ee59164d3259667d3cade58f4c93b4dddf5a92b
SHA512 a8de7ab7f67cbe2bf25fd772c24344031322dfab77d07fd835109530450683c158f37955982e875a3acbbfaea2e72c0ba5a52d85f3e1e58984ec63c96f6c0ccd
SSDEEP 384:lPb2XaqB7HPBIkFEOUrz6+nYPL6RKtUEMUo7HI5JNNzFwhhiCI9Zh3VDldl99kmm:lPKP7PGLNzFpHjS3wh/IZ3
TLSH
T16CE24AD70A2D6443EFCBEC7092D9E657AC38B3D26B9544DB10BADA941DC3BC52B2801D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\baseboard
Size 114B
SHA256 bc9757b9aff5b1a46699222ef3b8e20b0f13dcd6025fc97eb1b05156a86d3c0f
MD5 ecfe3e4b2a3b368eb51b162df5efc843
SHA1 5de86225ba77b506cd8c954e3e2e6f824eb80869
SHA512 b68b2e28aff93ffcb702f8049e78202399be1ed7aaa51e38f9b1d575f004433f2eaf47aabc95c9a206da54533b53ba4bc98a3d5efe45fa3fa153b27d545a4a24
TLSH
T197B01238D0C32E03C00B8504003E849A35008C63CB406CB13B490A7C0B4C4EB7F979CC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\config.ini
Size 350B
SHA256 539d8941687bd776f188a736aaf14ffbc595ccbb65cc35ac450927da6e68cd5a
MD5 4249c70b0e286c2b6f3f148fc84a7ba9
SHA1 cbdf0c18743d29c9bbc47f953264ba689804418b
SHA512 41fd6ab76100ce4f3971640c6bf5500cbc8323786731e3ba90edfd2c99e57ca7435e0f32b2d7acf50526b655d83a09d58ff0ada933bccd7db0578826f385b09a
TLSH
T125E0ED7D56228516B6017E8D640B3201AC7BB5F37E408490EB2CB966B633C26C22340B
MD5 SHA1 SHA512 TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\nemu-downloader.exe
Size 3.4MB
SHA256 fb6018fa88f990efa179c0cdbe8f2d75074b8aa6d73beb061b4c2a2b97c2804d
MD5 570861b7c2dcfa199a1e9f9c8c4e6f9f
SHA1 ac25e69d5f070393ce0ed5fe1987816b7963313f
SHA512 744dad60eb6537dcb5b5a1c1bc60489c4adb589a74594f703845b47e9faa5e44ec4d3492fe2caf4681fdcd5ad92abd15b35f8a85681ebb9f4d3caa427e083feb
SSDEEP 49152:A6SyOQgVA1ldScGwa8vKHSFOAxTMmDGGmQTUo3W6uFFkOuPXAnIfM3wBnjhE:hJHCCHa8vKNAxTMmid6uFFkOuPXAn1
TLSH
T14BF59E01B791A139FDF305BA89BE461E483D7E31071888C793C8596E5AB5DD23E31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z8D933AD0\skin.zip
Size 182KB
SHA256 0393c0174a1865dd6a46217b7d3d98581f3fe0390d271987712274521dd60d47
MD5 e8275dec801432aa63b0d7f4cb8dd68a
SHA1 412a00e44429740803bf49690674346cb0f78920
SHA512 9758cef57d90f12c319e0c664de9e9ce6808392c68b063a209ab6a7518bc3903d9d9dffc139915483e3062aa8dfb6312e9d215d6f9ba57dbb5e1db8fed515cc8
SSDEEP 3072:7VsuHYrAgjyiF3P5aF7IeFM+9/6eSLK2hPSntOtLk0vOGHzBwOLlSS:qRsGhWMuFSLnqM7O4zB3x
TLSH
T1F30401DEF3A9F8A8C61F8B3290530242B4398589C274271B6FB45C749D8BF541F4975B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads