34084431a645df85a0880c02603039c42afe729228b81b0ec51f121002bf3f35

General

Target
2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe
Size 158KB
Sample260824-f8wttsyths
SHA256 34084431a645df85a0880c02603039c42afe729228b81b0ec51f121002bf3f35
MD5 910cc2366fa6cfc55d4e029286215bd4
SHA1 3284c61699b2ac735e2bc106803e2632387aefd4
SHA512 59a48d55f6f62924b3f9dcba583fbcefe8d68e346c036c4c55633c7847c20a8ed8b7a94e24234e002ffc5d489646b5b08e8afe23231290679331bf92579c5a1f
SSDEEP 3072:styPzouIS9HF2D3N22QYFThvV0Xvw4wLl43njswdolSNii47BxG:5pISFULzQYDd0fkC3njswdolO4fG
TLSH
T153F312A6BDD80662E5050A7AA19BBB3B0F35B5E95007F3488F12CC668CED13DE036D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.bat	sqlserver.exe

Executes dropped EXE 2 IoCs

pid	Process
4308	sqlserver.exe
1496	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dumpkernel.exe	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5468	cmd.exe
896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sqlserver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sqlserver.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4308	2936	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe	89
PID 2936 wrote to memory of 5468	2936	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe	90
PID 2936 wrote to memory of 896	2936	2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe	92
PID 896 wrote to memory of 1496	896	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\temp\sqlserver.exe
  "C:\Windows\temp\sqlserver.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_910cc2366fa6cfc55d4e029286215bd4_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlserver.exe

Path C:\Windows\Temp\sqlserver.exe
Size 15KB
SHA256 23fea8b183632f91e5a4d1d6a43283846c734eee820eb2084ad428b7cbe92d53
MD5 c83a01f25ea0e1c9200c5893aa2d2199
SHA1 d0c53a1aaf2be6aec7b0f73e767b62fffb010f08
SHA512 3961ce6f4e8871a5032fc5616e057e15892d846270d572f156aebd5557b72cf5dd0139e87306073243b366851e6db09b83f41294a8230836597c2c840e2704d7
SSDEEP 384:y4Od9Q2hJy5g75oOuHh7parHdAI0ptTvzTn:y4aQ2hJyjOuHhntzz
TLSH
T1D3623D5A79479F43C594C0B12B68AB38E7B9B4773D188053D740CE483E7F8819529F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\Temp\tttbrozzz.bat
Size 582B
SHA256 5f009820b9fd125b2f74e49f58a417264a196e12c17340e3d164d6219d3a41cb
MD5 cf2ac56ebc6321ffac15ceedffd5addf
SHA1 042d123a4553b1ebc935ffc3f70fa3fbc1cc62bf
SHA512 f5cb823b3a26f2436efcd8f937b5fe4466a65cf0f193ccc22c516381b9297b4596b64a5d8c0cb7a9ce29b45c32672b525b475b930595976b4f7febee510d14c4
TLSH
T114F04C10C2FEC1E59869941B27B67B0AE311B925AE5527144B14820BA880C8FFEA7652
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\Temp\tttdelzzz.bat
Size 313B
SHA256 fc03b816227acd6c584eb7587b910ce75735dd8ddc0676fe2a18d9b999995513
MD5 dff6a407063f6e5bbd8eb209af904d31
SHA1 c0a35f7c4249859798937eea674afc7b162769b3
SHA512 c162288c8a1f80b7108f2621702b42ad1314efeb82a4df8fc3da3ae7828014b7f8265f40b31a1def80532821de088b879c0bc474811c4c371154069d075c1629
TLSH
T1C6E07D24D5F8C1C6CC39501B73B13B46D6057E551D4A13085F158102A8C08CFBCD6642
MD5 SHA1 SHA512 TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 113KB
SHA256 aed477264f3eb56af80bf8ed0546726e979072652cf32599f4c87e6ef12dda44
MD5 fde822d9d972c8d1b756ef257f44731c
SHA1 07d88def6cc7f9bc6b2d53011d451d681486787f
SHA512 f4a4ca474572497443611b09317cbfa7d9d25c5d798cf0b54612008e40f931fb7b420708a821ec1b92f1f20990b508c9b1d12d52a247f343996b41e17996bd32
SSDEEP 1536:V80/XUxF7Uk5OJUbOITE0G7opgbb15Zor4Tklz:2v7EUbX60pgbb15Zo0m
TLSH
T143B35B127AD380B3E451053489A597C54B7EFE237FA325EFBB98334D0EB12C40A756A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads