Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 17:52
General
- Target 2026-08-27_503743f18eefeeb7ab790f0728b973fe_elex_wannacry.exe
- Size 608KB
- Sample260827-wft3jayhqa
- SHA256 9ea206642772a5b67d26ad787ab13180e27be1ae56bf7ee6290bb845e698b12d
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 23 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_503743f18eefeeb7ab790f0728b973fe_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_503743f18eefeeb7ab790f0728b973fe_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/540-56-0x0000022A10CD0000-0x0000022A10E02000-memory.dmp
memory/540-58-0x0000022A10F30000-0x0000022A10F96000-memory.dmp
memory/540-57-0x0000022A10F30000-0x0000022A10F96000-memory.dmp
memory/644-179-0x00007FF797820000-0x00007FF7978C7000-memory.dmp
memory/644-119-0x00000155DCBF0000-0x00000155DCC56000-memory.dmp
memory/644-118-0x00000155DCBF0000-0x00000155DCC56000-memory.dmp
memory/644-117-0x00007FF797820000-0x00007FF7978C7000-memory.dmp
memory/1076-208-0x00007FF689EA0000-0x00007FF68A02E000-memory.dmp
memory/1076-162-0x00000218CE5E0000-0x00000218CE646000-memory.dmp
memory/1076-161-0x00000218CE5E0000-0x00000218CE646000-memory.dmp
memory/1076-160-0x00007FF689EA0000-0x00007FF68A02E000-memory.dmp
memory/1444-48-0x0000026626CA0000-0x0000026626D06000-memory.dmp
memory/1444-47-0x0000026626A40000-0x0000026626B72000-memory.dmp
memory/1444-49-0x0000026626CA0000-0x0000026626D06000-memory.dmp
memory/1780-27-0x0000024440310000-0x0000024440376000-memory.dmp
memory/1780-76-0x00007FF6DAE70000-0x00007FF6DAF53000-memory.dmp
memory/1780-28-0x0000024440310000-0x0000024440376000-memory.dmp
memory/1780-26-0x00007FF6DAE70000-0x00007FF6DAF53000-memory.dmp
memory/1796-64-0x00000279974B0000-0x0000027997516000-memory.dmp
memory/1796-73-0x00007FF687E50000-0x00007FF687FB7000-memory.dmp
memory/1796-71-0x00000279974B0000-0x0000027997516000-memory.dmp
memory/1796-66-0x00007FF687E50000-0x00007FF687FB7000-memory.dmp
memory/1796-65-0x00000279974B0000-0x0000027997516000-memory.dmp
memory/2000-200-0x00007FF79F640000-0x00007FF79FB6A000-memory.dmp
memory/2000-268-0x00007FF79F640000-0x00007FF79FB6A000-memory.dmp
memory/2000-201-0x0000022922670000-0x00000229226D6000-memory.dmp
memory/2000-202-0x0000022922670000-0x00000229226D6000-memory.dmp
memory/2180-151-0x00007FF6DEDA0000-0x00007FF6DEF8E000-memory.dmp
memory/2180-199-0x00007FF6DEDA0000-0x00007FF6DEF8E000-memory.dmp
memory/2180-153-0x000001A55FD80000-0x000001A55FDE6000-memory.dmp
memory/2180-152-0x000001A55FD80000-0x000001A55FDE6000-memory.dmp
memory/2420-240-0x000001EBCCBF0000-0x000001EBCCC00000-memory.dmp
memory/2420-218-0x000001EBCBA80000-0x000001EBCBAE6000-memory.dmp
memory/2420-220-0x00007FF65B470000-0x00007FF65B7C3000-memory.dmp
memory/2420-221-0x000001EBCBA80000-0x000001EBCBAE6000-memory.dmp
memory/2420-272-0x00007FF65B470000-0x00007FF65B7C3000-memory.dmp
memory/2420-269-0x000001EBD6640000-0x000001EBD6648000-memory.dmp
memory/2420-224-0x000001EBCC9C0000-0x000001EBCC9D0000-memory.dmp
memory/2420-256-0x000001EBD4FB0000-0x000001EBD4FB8000-memory.dmp
memory/2568-97-0x00007FF6640F0000-0x00007FF6641D9000-memory.dmp
memory/2568-98-0x000002C298150000-0x000002C2981B6000-memory.dmp
memory/2568-99-0x000002C298150000-0x000002C2981B6000-memory.dmp
memory/2568-166-0x00007FF6640F0000-0x00007FF6641D9000-memory.dmp
memory/2732-143-0x00007FF6FDE50000-0x00007FF6FE173000-memory.dmp
memory/2732-193-0x00007FF6FDE50000-0x00007FF6FE173000-memory.dmp
memory/2732-142-0x0000018743C60000-0x0000018743CC6000-memory.dmp
memory/2732-144-0x0000018743C60000-0x0000018743CC6000-memory.dmp
memory/2888-53-0x00007FF6AB4B0000-0x00007FF6AB596000-memory.dmp
memory/2888-18-0x0000026068420000-0x0000026068486000-memory.dmp
memory/2888-17-0x00007FF6AB4B0000-0x00007FF6AB596000-memory.dmp
memory/2888-15-0x0000026068420000-0x0000026068486000-memory.dmp
memory/2904-91-0x00000203E3250000-0x00000203E32B6000-memory.dmp
memory/2904-90-0x00000203E3250000-0x00000203E32B6000-memory.dmp
memory/2904-89-0x00000203E2FF0000-0x00000203E3122000-memory.dmp
memory/3112-125-0x00000210BE700000-0x00000210BE766000-memory.dmp
memory/3112-196-0x00007FF6F73F0000-0x00007FF6F785C000-memory.dmp
memory/3112-126-0x00000210BE700000-0x00000210BE766000-memory.dmp
memory/3112-130-0x00007FF6F73F0000-0x00007FF6F785C000-memory.dmp
memory/3112-194-0x00000210BE700000-0x00000210BE766000-memory.dmp
memory/3112-183-0x00007FF6F73F0000-0x00007FF6F785C000-memory.dmp
memory/3208-187-0x0000012658320000-0x0000012658386000-memory.dmp
memory/3208-188-0x0000012658320000-0x0000012658386000-memory.dmp
memory/3208-189-0x00007FF66AC70000-0x00007FF66B14C000-memory.dmp
memory/3208-265-0x00007FF66AC70000-0x00007FF66B14C000-memory.dmp
memory/3792-210-0x000001E6A0880000-0x000001E6A08E6000-memory.dmp
memory/3792-211-0x00007FF72BDC0000-0x00007FF72BEFA000-memory.dmp
memory/3792-209-0x000001E6A0880000-0x000001E6A08E6000-memory.dmp
memory/3792-271-0x00007FF72BDC0000-0x00007FF72BEFA000-memory.dmp
memory/3916-78-0x00000203395A0000-0x0000020339606000-memory.dmp
memory/3916-77-0x00007FF744C80000-0x00007FF744D93000-memory.dmp
memory/3916-159-0x00007FF744C80000-0x00007FF744D93000-memory.dmp
memory/3916-79-0x00000203395A0000-0x0000020339606000-memory.dmp
memory/4324-43-0x00007FF7A0E30000-0x00007FF7A10B7000-memory.dmp
memory/4324-34-0x00007FF7A0E30000-0x00007FF7A10B7000-memory.dmp
memory/4324-41-0x0000026DC48B0000-0x0000026DC4916000-memory.dmp
memory/4324-35-0x0000026DC48B0000-0x0000026DC4916000-memory.dmp
memory/4324-37-0x0000026DC48B0000-0x0000026DC4916000-memory.dmp
memory/4576-1-0x00000000022D0000-0x0000000002339000-memory.dmp
memory/4576-0-0x0000000000400000-0x00000000004A3000-memory.dmp
memory/4576-44-0x0000000000400000-0x00000000004A3000-memory.dmp
memory/4576-7-0x00000000022D0000-0x0000000002339000-memory.dmp
memory/5240-282-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-287-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-284-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-275-0x000001F226400000-0x000001F2282D7000-memory.dmp
memory/5240-288-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-283-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-289-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-292-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-286-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-290-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-291-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5240-285-0x000001F228ED0000-0x000001F228EE0000-memory.dmp
memory/5292-171-0x0000013259BA0000-0x0000013259C06000-memory.dmp
memory/5292-175-0x00007FF785810000-0x00007FF785C38000-memory.dmp
memory/5292-176-0x0000013259BA0000-0x0000013259C06000-memory.dmp
memory/5292-170-0x0000013259BA0000-0x0000013259C06000-memory.dmp
memory/5292-178-0x00007FF785810000-0x00007FF785C38000-memory.dmp
memory/5780-105-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/5780-111-0x0000000000840000-0x00000000008A9000-memory.dmp
memory/5780-169-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/5780-106-0x0000000000840000-0x00000000008A9000-memory.dmp
memory/5808-135-0x000001603D200000-0x000001603D266000-memory.dmp
memory/5808-134-0x000001603D200000-0x000001603D266000-memory.dmp
memory/5808-139-0x00007FF702510000-0x00007FF7025BA000-memory.dmp
memory/5808-186-0x00007FF702510000-0x00007FF7025BA000-memory.dmp
memory/6012-261-0x00007FF750440000-0x00007FF7506FD000-memory.dmp
memory/6012-182-0x00007FF750440000-0x00007FF7506FD000-memory.dmp