Analysis
- max time kernel
148s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 03:44
General
- Target 2026-08-23_9e18ef5adb5e44509970bdc128cb5c64_elex_wannacry.exe
- Size 170KB
- Sample260824-eay1vscn2y
- SHA256 72a751148fa924c68ba261884ced5675f08914e1f3a450f32463ad5192edc6aa
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 4 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_9e18ef5adb5e44509970bdc128cb5c64_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9e18ef5adb5e44509970bdc128cb5c64_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\sqlserver.exe"C:\Windows\temp\sqlserver.exe"2⤵
- Modifies firewall policy service
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_9e18ef5adb5e44509970bdc128cb5c64_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9e18ef5adb5e44509970bdc128cb5c64_elex_wannacry.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 5404⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 5723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2320 -ip 23201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4292 -ip 42921⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
DUMPKERNEL.EXE
sqlserver.exe
tttbrozzz.bat
tttdelzzz.bat
Server32History.dat
memory/2320-30-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2320-36-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4212-32-0x0000000076FE8000-0x0000000076FE9000-memory.dmp
memory/4212-33-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/4212-35-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/4212-34-0x0000000076FE9000-0x0000000076FEA000-memory.dmp
memory/4212-31-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/4212-42-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/4212-43-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/4292-39-0x0000000076FE9000-0x0000000076FEA000-memory.dmp
memory/4292-38-0x000000007FB10000-0x000000007FB1C000-memory.dmp
memory/4292-37-0x0000000076FE8000-0x0000000076FE9000-memory.dmp
memory/4292-41-0x000000007FB10000-0x000000007FB1C000-memory.dmp