Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/08/2026, 17:52
General
- Target 2026-08-27_503743f18eefeeb7ab790f0728b973fe_elex_wannacry.exe
- Size 608KB
- Sample260827-wft3jayhqa
- SHA256 9ea206642772a5b67d26ad787ab13180e27be1ae56bf7ee6290bb845e698b12d
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_503743f18eefeeb7ab790f0728b973fe_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_503743f18eefeeb7ab790f0728b973fe_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 1664 1668 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3048 1636 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/1108-46-0x000001DA55560000-0x000001DA555C6000-memory.dmp
memory/1108-47-0x000001DA55560000-0x000001DA555C6000-memory.dmp
memory/1108-45-0x000001DA552D0000-0x000001DA55402000-memory.dmp
memory/1132-205-0x000002175C9A0000-0x000002175CA06000-memory.dmp
memory/1132-206-0x000002175C9A0000-0x000002175CA06000-memory.dmp
memory/1132-204-0x00007FF78CFA0000-0x00007FF78D4A6000-memory.dmp
memory/1132-243-0x00007FF78CFA0000-0x00007FF78D4A6000-memory.dmp
memory/1340-157-0x0000025E081B0000-0x0000025E08216000-memory.dmp
memory/1340-156-0x0000025E081B0000-0x0000025E08216000-memory.dmp
memory/1340-155-0x00007FF7F7180000-0x00007FF7F7422000-memory.dmp
memory/1340-203-0x00007FF7F7180000-0x00007FF7F7422000-memory.dmp
memory/1652-75-0x00007FF7E1D70000-0x00007FF7E1E88000-memory.dmp
memory/1652-76-0x000002016ED60000-0x000002016EDC6000-memory.dmp
memory/1652-134-0x00007FF7E1D70000-0x00007FF7E1E88000-memory.dmp
memory/1652-77-0x000002016ED60000-0x000002016EDC6000-memory.dmp
memory/1852-28-0x0000023E82B50000-0x0000023E82BB6000-memory.dmp
memory/1852-27-0x0000023E82B50000-0x0000023E82BB6000-memory.dmp
memory/1852-62-0x00007FF7FA7D0000-0x00007FF7FA897000-memory.dmp
memory/1852-26-0x00007FF7FA7D0000-0x00007FF7FA897000-memory.dmp
memory/1852-29-0x0000023E82B50000-0x0000023E82BB6000-memory.dmp
memory/1980-87-0x000001D8A4C60000-0x000001D8A4D92000-memory.dmp
memory/1980-89-0x000001D8A4EF0000-0x000001D8A4F56000-memory.dmp
memory/1980-88-0x000001D8A4EF0000-0x000001D8A4F56000-memory.dmp
memory/2396-254-0x00007FF7EC5B0000-0x00007FF7ECCF2000-memory.dmp
memory/2396-252-0x0000028498550000-0x00000284985B6000-memory.dmp
memory/2396-117-0x0000028498550000-0x00000284985B6000-memory.dmp
memory/2396-118-0x00007FF7EC5B0000-0x00007FF7ECCF2000-memory.dmp
memory/2396-119-0x0000028498550000-0x00000284985B6000-memory.dmp
memory/2396-181-0x00007FF7EC5B0000-0x00007FF7ECCF2000-memory.dmp
memory/2540-55-0x00000200D7CF0000-0x00000200D7D56000-memory.dmp
memory/2540-56-0x00000200D7CF0000-0x00000200D7D56000-memory.dmp
memory/2540-54-0x00000200D7A90000-0x00000200D7BC2000-memory.dmp
memory/3084-184-0x00007FF6FA300000-0x00007FF6FA3AC000-memory.dmp
memory/3084-125-0x00007FF6FA300000-0x00007FF6FA3AC000-memory.dmp
memory/3084-126-0x000001B091440000-0x000001B0914A6000-memory.dmp
memory/3084-127-0x000001B091440000-0x000001B0914A6000-memory.dmp
memory/3280-180-0x00007FF694170000-0x00007FF694490000-memory.dmp
memory/3280-178-0x0000028C57E60000-0x0000028C57EC6000-memory.dmp
memory/3280-174-0x0000028C57E60000-0x0000028C57EC6000-memory.dmp
memory/3280-173-0x0000028C57E60000-0x0000028C57EC6000-memory.dmp
memory/3280-172-0x00007FF694170000-0x00007FF694490000-memory.dmp
memory/3940-146-0x0000026E28830000-0x0000026E28896000-memory.dmp
memory/3940-145-0x00007FF7E8090000-0x00007FF7E8142000-memory.dmp
memory/3940-200-0x00007FF7E8090000-0x00007FF7E8142000-memory.dmp
memory/3940-147-0x0000026E28830000-0x0000026E28896000-memory.dmp
memory/4156-220-0x00000265B8FC0000-0x00000265B9026000-memory.dmp
memory/4156-250-0x00007FF60E330000-0x00007FF60E45E000-memory.dmp
memory/4156-218-0x00007FF60E330000-0x00007FF60E45E000-memory.dmp
memory/4156-219-0x00000265B8FC0000-0x00000265B9026000-memory.dmp
memory/4168-136-0x000002B126CF0000-0x000002B126D56000-memory.dmp
memory/4168-137-0x000002B126CF0000-0x000002B126D56000-memory.dmp
memory/4168-135-0x00007FF745020000-0x00007FF745435000-memory.dmp
memory/4168-212-0x00007FF745020000-0x00007FF745435000-memory.dmp
memory/4168-210-0x000002B126CF0000-0x000002B126D56000-memory.dmp
memory/4168-199-0x00007FF745020000-0x00007FF745435000-memory.dmp
memory/4224-37-0x0000000000400000-0x00000000004A3000-memory.dmp
memory/4224-7-0x0000000002460000-0x00000000024C9000-memory.dmp
memory/4224-6-0x0000000002460000-0x00000000024C9000-memory.dmp
memory/4224-0-0x0000000000400000-0x00000000004A3000-memory.dmp
memory/4224-1-0x0000000002460000-0x00000000024C9000-memory.dmp
memory/4672-163-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/4672-111-0x0000000000810000-0x0000000000879000-memory.dmp
memory/4672-105-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/4672-106-0x0000000000810000-0x0000000000879000-memory.dmp
memory/4816-38-0x00000243AB030000-0x00000243AB096000-memory.dmp
memory/4816-36-0x00000243AB030000-0x00000243AB096000-memory.dmp
memory/4816-39-0x00000243AB030000-0x00000243AB096000-memory.dmp
memory/4816-35-0x00007FF7FA7D0000-0x00007FF7FA897000-memory.dmp
memory/4816-93-0x00007FF7FA7D0000-0x00007FF7FA897000-memory.dmp
memory/4992-193-0x00007FF6D1F60000-0x00007FF6D2430000-memory.dmp
memory/4992-195-0x000002C8FE0F0000-0x000002C8FE156000-memory.dmp
memory/4992-194-0x000002C8FE0F0000-0x000002C8FE156000-memory.dmp
memory/4992-225-0x00007FF6D1F60000-0x00007FF6D2430000-memory.dmp
memory/5132-99-0x000002DD09040000-0x000002DD090A6000-memory.dmp
memory/5132-98-0x000002DD09040000-0x000002DD090A6000-memory.dmp
memory/5132-96-0x00007FF6045B0000-0x00007FF6046F8000-memory.dmp
memory/5132-154-0x00007FF6045B0000-0x00007FF6046F8000-memory.dmp
memory/5296-15-0x00007FF6FCBB0000-0x00007FF6FCCD1000-memory.dmp
memory/5296-16-0x00000239EA490000-0x00000239EA4F6000-memory.dmp
memory/5296-18-0x00000239EA490000-0x00000239EA4F6000-memory.dmp
memory/5296-17-0x00000239EA490000-0x00000239EA4F6000-memory.dmp
memory/5296-51-0x00007FF6FCBB0000-0x00007FF6FCCD1000-memory.dmp
memory/5696-213-0x00007FF69F360000-0x00007FF69F4F3000-memory.dmp
memory/5696-166-0x000001A9AE790000-0x000001A9AE7F6000-memory.dmp
memory/5696-165-0x000001A9AE790000-0x000001A9AE7F6000-memory.dmp
memory/5696-164-0x00007FF69F360000-0x00007FF69F4F3000-memory.dmp
memory/5700-229-0x000002AC6EEF0000-0x000002AC6EF56000-memory.dmp
memory/5700-230-0x000002AC6EEF0000-0x000002AC6EF56000-memory.dmp
memory/5700-228-0x00007FF7DA1C0000-0x00007FF7DA4FE000-memory.dmp
memory/5700-251-0x00007FF7DA1C0000-0x00007FF7DA4FE000-memory.dmp
memory/5940-64-0x000001FBD87F0000-0x000001FBD8856000-memory.dmp
memory/5940-70-0x000001FBD87F0000-0x000001FBD8856000-memory.dmp
memory/5940-72-0x00007FF736470000-0x00007FF7365D7000-memory.dmp
memory/5940-63-0x00007FF736470000-0x00007FF7365D7000-memory.dmp
memory/5940-65-0x000001FBD87F0000-0x000001FBD8856000-memory.dmp
memory/6072-217-0x00007FF7A0EE0000-0x00007FF7A116A000-memory.dmp
memory/6072-185-0x00007FF7A0EE0000-0x00007FF7A116A000-memory.dmp
memory/6072-186-0x0000022B768A0000-0x0000022B76906000-memory.dmp
memory/6072-187-0x0000022B768A0000-0x0000022B76906000-memory.dmp