cd33eec3edcf4125031b1dee04d854f236722b0e9a2837a8d6679c34a673db13

General

Target
2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe
Size 24KB
Sample260826-djs1jabe63
SHA256 cd33eec3edcf4125031b1dee04d854f236722b0e9a2837a8d6679c34a673db13
MD5 efa91e8d80b8e5a0e33f168630cbd58f
SHA1 a3bb7654c28f762852ae3f63327a65fa5fd89412
SHA512 e379cf89bf31ac6992e9d92e6b5256ad0537310faf22cafb8c7eb1269e8ca4419be69d10c7e5328e1bbec368d9029132aafeb3b97c94f29e9c4a0e691476c647
SSDEEP 384:E3pES+/xwGkRKJv2DlM61qmTTMVF9/q5z40:fS+ZfbJvuO8qYoAV
TLSH
T1EBB22A1FA38545F1EBD582301DAF1BBEE56ABC62472986931B20EF1D1C31660D9363CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2928	spoolsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2508	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1124	cmd.exe
2776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3324	ipconfig.exe
4820	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	tasklist.exe
Token: SeDebugPrivilege	4820	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3140	2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe
3140	2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe
2928	spoolsv.exe
2928	spoolsv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1124	3140	2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe	86
PID 1124 wrote to memory of 2776	1124	cmd.exe	88
PID 1124 wrote to memory of 3324	1124	cmd.exe	89
PID 1124 wrote to memory of 2508	1124	cmd.exe	90
PID 1124 wrote to memory of 5028	1124	cmd.exe	92
PID 5028 wrote to memory of 696	5028	net.exe	93
PID 1124 wrote to memory of 4820	1124	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_efa91e8d80b8e5a0e33f168630cbd58f_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:3324
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      System Location Discovery: System Language Discovery
      PID:696
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4820

C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe
"C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe
Size 24KB
SHA256 fdccb67bde3919e205bd07f8aca0575fafabcda209be865214c66fae97700ebd
MD5 497deb1f43177ced7e1c8fa90ce2101c
SHA1 a5ed1721c623f187cf4bdc0cccf54cd5eddc4fb8
SHA512 9a7220afe51364e02f66ab406474ac3eb9e1b61a176bbbf5c83b558445325f3dc5ee3acf94c541cef41c51cb02f40190d0c16a8415b5766bfc1ecc35dd34bc1b
SSDEEP 384:E3pES+/xwGkRKJQOlM61qmTTMVF9/q5c40:fS+ZfbJQOO8qYoAe
TLSH
T18EB22B1FA7C541F1DB95823019BB1BBEE57AB862473946971B20EE0D1C32760D6363CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flash.log

Path \??\c:\windows\temp\flash.log
Size 14KB
SHA256 6ef2e9d38b760219425341ffc7814063a1ab81260faa07bc2f83614f17ea4624
MD5 3cea3f63a4537137d12bb659a0afca17
SHA1 c9995e27b9b24f829038050d656d4d9b014f4caa
SHA512 1d543ab2b722bbe6a0feb99af43f683bf20842e32ca8845df53045571a34246979b94a6cc6f746cbb6a3719dca094bb53ec2f6041f7212efa27ca289f049ef0a
SSDEEP 384:nmVrIxKTZhx3Golo53rzNIWHSFq5qAH0ZSx93K/Qm8tozgGiwMk8CB9eTbYTWFk/:mZ/THxWolo53rzNIWHSFq5qAH0ZSx93w
TLSH
T1DB629741559E60EC6379C3963E178022E74E5542346FECD83EED049CABF8B1CABEB560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads