28a5d9436a040d4c915290c1a948450ffef9fb006884d5cc050eeb2616f5b277

General

Target
2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe
Size 60KB
Sample260825-e9fzbsel6z
SHA256 28a5d9436a040d4c915290c1a948450ffef9fb006884d5cc050eeb2616f5b277
MD5 abae588c1f1c8aab538c6937f72df09f
SHA1 cf55df91625985e4665923a82b2a7aca1247f5f3
SHA512 465870571d4ffa6b73442ba5d3484c21ece1eea699a8bfa8654ed83f1e836b3870cd15d7799d58ef300acafecf953ade0029c83db52ca673fe25e514c1893512
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwy404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroo4/Clsrul
TLSH
T1B75319835BEE5CF2F7951231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3836	w992637B5fD5D7v403c2AEE484857F652ACDBl.exe
412	wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
3620	w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
3492	w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
5096	w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
3484	w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe
3004	w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe	wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
File created	C:\Windows\w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe	w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
File created	C:\Windows\w745A6664f5258v4cae28CCE84BB993EC59B0l.exe	w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
File created	C:\Windows\w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe	w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
File created	C:\Windows\w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe	w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe
File created	C:\Windows\w992637B5fD5D7v403c2AEE484857F652ACDBl.exe	2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe
File created	C:\Windows\wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe	w992637B5fD5D7v403c2AEE484857F652ACDBl.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3472	cmd.exe
1284	cmd.exe
2216	cmd.exe
2604	cmd.exe
3304	cmd.exe
1700	cmd.exe
2172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w992637B5fD5D7v403c2AEE484857F652ACDBl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2520	2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3836	w992637B5fD5D7v403c2AEE484857F652ACDBl.exe
Token: SeIncBasePriorityPrivilege	412	wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
Token: SeIncBasePriorityPrivilege	3620	w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
Token: SeIncBasePriorityPrivilege	3492	w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
Token: SeIncBasePriorityPrivilege	5096	w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
Token: SeIncBasePriorityPrivilege	3484	w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3836	2520	2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe	92
PID 2520 wrote to memory of 3304	2520	2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe	93
PID 3836 wrote to memory of 412	3836	w992637B5fD5D7v403c2AEE484857F652ACDBl.exe	94
PID 3836 wrote to memory of 1700	3836	w992637B5fD5D7v403c2AEE484857F652ACDBl.exe	95
PID 412 wrote to memory of 3620	412	wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe	97
PID 412 wrote to memory of 2172	412	wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe	98
PID 3620 wrote to memory of 3492	3620	w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe	99
PID 3620 wrote to memory of 3472	3620	w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe	100
PID 3492 wrote to memory of 5096	3492	w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe	102
PID 3492 wrote to memory of 1284	3492	w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe	103
PID 5096 wrote to memory of 3484	5096	w745A6664f5258v4cae28CCE84BB993EC59B0l.exe	104
PID 5096 wrote to memory of 2216	5096	w745A6664f5258v4cae28CCE84BB993EC59B0l.exe	105
PID 3484 wrote to memory of 3004	3484	w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe	106
PID 3484 wrote to memory of 2604	3484	w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_abae588c1f1c8aab538c6937f72df09f_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\w992637B5fD5D7v403c2AEE484857F652ACDBl.exe
  C:\Windows\w992637B5fD5D7v403c2AEE484857F652ACDBl.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
    C:\Windows\wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
      C:\Windows\w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\Windows\w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
        
        C:\Windows\w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3492
      - C:\Windows\w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
        
        C:\Windows\w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe
        
        C:\Windows\w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe
        
        C:\Windows\w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W6F33F~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W745A6~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2216
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W5FB86~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1284
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W5A774~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\WD2ABB~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\W99263~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe

Path C:\Windows\w5A7749B4f894Ev45f12A3008FA3E0DC983D9l.exe
Size 60KB
SHA256 f18f0ba08ec52cebc4edcd56b1e29e3f12e1be75b68d28d4e3d280e2b4072f4a
MD5 bea8cbcd86b19e0f2cf4014859a73488
SHA1 661d8997d636110727c1d97aee179cf76c31054d
SHA512 47f83f8fe135735332a44bcb2379dc55fb9117c74d3331fca5c33473f1f1332fdf3fb577c6ff3f93283457b679ea0e2fb6bd0715dfffdd4fac576f1602960c1b
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw1P404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroX4/Clsrul
TLSH
T1025319835BEE5CF2F7911231087C8BB9927B99D4A50DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe

Path C:\Windows\w5FB8651Ef0934v4fd7281A48978B5BA34E38l.exe
Size 60KB
SHA256 ab58c951ad603979f969a2376fcbd48fe5c48706499895d731a473790cdf2a01
MD5 e5078b563d07f41c30f07f0f8a87f1ff
SHA1 18b61ef1b1e44e988a3f7ae12230187adcf03808
SHA512 6c546f8c230f86b60337cd6d6f7e49ce7a371f476bc641de1cdb649e03a57439640416761fef53780d4169cd7ceaa51ce3802ca6919d3e5656c9f38fa3922dbd
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwL404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroN4/Clsrul
TLSH
T13E5319835BEE5CF2F7911131087C8BB9927B99D4950DBEDFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe

Path C:\Windows\w6F33FF9Cf57E9v4f9b2B0E18EF5DD0F87569l.exe
Size 60KB
SHA256 d7077bc241cb3b51921adc082727ccf010a7604ff8ad6d6072c185574e22974b
MD5 66473abc6a0e58171a32b2f9ff9e3b7a
SHA1 4630143bc0d2d539b21bb0bd07f42e45e7b3b8c1
SHA512 1f40175d09594ec828a9910633091391eaf36d914cfa68f74594258f7f39f0a764514f869f75fa81904118f16f476bb1a117a3de7d59053f10def8574de1c38d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwN404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLro/4/Clsrul
TLSH
T1635319835BEE5CF2F7951231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w745A6664f5258v4cae28CCE84BB993EC59B0l.exe

Path C:\Windows\w745A6664f5258v4cae28CCE84BB993EC59B0l.exe
Size 60KB
SHA256 ca74eccdf894bb4802c6e34b29eaaac1d7d4f084e225f4aeac048815b759eea7
MD5 2baf723225d6b340f98dde7c43070ddd
SHA1 7ce6ad80736c935052744573d3ec2fdbae38bbef
SHA512 32a40f3eb1c6e3bdf7356bd672f0981e77945de872d158e5bf3daf63ca7ddd7e7a43d2dab6d365295f3835346b5381d1d8a6304a2b9232491d80064a2e66cd3d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwj3404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrod4/Clsrul
TLSH
T1E25319835BEE5CF2F7951131087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe

Path C:\Windows\w930B58C5fC137v44b82B1F78EFB1301D7DCBl.exe
Size 60KB
SHA256 544f3671af65c22302ae07a4ecee8605d9abd3bf4e9fe21cb19e85e5fbec1728
MD5 baa2f0bb54248008798cf3d9ff9034b3
SHA1 74c228cfb078cbfe6ab6fb710bab988574359195
SHA512 ceb41ca4a49d6d44b9efc17b86eac3879bc1d44cd11c7c971b76cca85da6f77b1b7819441665b3b448ada27e282af44262585a679cc7fb2f849cd904dad90ebd
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwg404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroO4/Clsrul
TLSH
T1FF5319835BEE5CF2F7911231087C8BB9927B99D4950EBEDFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w992637B5fD5D7v403c2AEE484857F652ACDBl.exe

Path C:\Windows\w992637B5fD5D7v403c2AEE484857F652ACDBl.exe
Size 60KB
SHA256 91b414d5ae8da3226f9d816edf91b3067842f78d84dc2d350ca273334485f2e5
MD5 f29c996ad582b6538fd7e6ea3e951f4f
SHA1 8080482243f983c08c190c793de2c8e8844dda37
SHA512 88cca725549c4a3d17b01c17743893c72bf796fcd3ffb90b6aee0474b0b6919f3fe160c184d0966a3b966088acff8da4d4b9919ddf6a7fcfa30f2efc7935013d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwa404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrow4/Clsrul
TLSH
T11F5319835BEE5CF2F7911231087C8BB9927B99D4950DBEDFAB50CD544037292E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe

Path C:\Windows\wD2ABBF05fE6C3v4be22A5D28552879782A33l.exe
Size 60KB
SHA256 b03f0cf2ced7cf0cf91ac074f2165f054da904a7372a1921e3fc5202036e0504
MD5 4476026333317e8db42390e80e071563
SHA1 1fc9dd6068e736b448a8d53675c1df671139f375
SHA512 7aeb3fce3e483309fec263b6fe99586c862e265ca359731e4a3a6d59f652758825e398ef50e9518c3bb192123122eb5f61ceef11c63e9e56f4936fb3c7ffc1d1
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw9404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroP4/Clsrul
TLSH
T1375319835BEE5CF2F7911131087C8BB9927B99D4950DBEDFAB40CE544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads