afd1ed63870399ae664792942b20c6673bc4a69ce527e7d4975cdb0cadde0ba9

General

Target
2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe
Size 24KB
Sample260905-vps16ayfma
SHA256 afd1ed63870399ae664792942b20c6673bc4a69ce527e7d4975cdb0cadde0ba9
MD5 1b2985ea1674e66de437541ffe18b61d
SHA1 ce0c1da66858c777a8b3028e7ad9dbdb6d24f425
SHA512 944897d2953270e669f0f928c05381ef94ca257fd7581b45502ee38fc81c632973360d285fe529e9ec717b936c36869b35a85bb962477ee225ca90e237009135
SSDEEP 384:E3pES+/xwGkRKJuY/NlM61qmTTMVF9/q5I40:fS+ZfbJuY1O8qYoAS
TLSH
T13CB21A1FA3C545F1EB9582302DAB16BEE57AB862472986931B20EA1D1C31770D5363CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5384	spoolsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3588	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4956	cmd.exe
5104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1332	NETSTAT.EXE
5112	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	tasklist.exe
Token: SeDebugPrivilege	1332	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
936	2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe
936	2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe
5384	spoolsv.exe
5384	spoolsv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4956	936	2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe	90
PID 4956 wrote to memory of 5104	4956	cmd.exe	92
PID 4956 wrote to memory of 5112	4956	cmd.exe	93
PID 4956 wrote to memory of 3588	4956	cmd.exe	94
PID 4956 wrote to memory of 1420	4956	cmd.exe	97
PID 1420 wrote to memory of 4432	1420	net.exe	98
PID 4956 wrote to memory of 1332	4956	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_1b2985ea1674e66de437541ffe18b61d_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5104
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:5112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1332

C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe
"C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Program Files\Common Files\microsoft shared\Web Folders\1033\spoolsv.exe
Size 24KB
SHA256 947dbb2e0c525099b3a1b87594d8b08ecdcb728f9b28670deb709641fcda5b66
MD5 70a133e6a7f0a33ee7d8d7f581a6bc0a
SHA1 d2ece34644dc4f8b12897dcbf6904cf427b7bcc9
SHA512 1ae41898172828c181f2892867174ad016700a900e285eef4ec670f2a0c5973b5349a86169cce1e47a2b718818f23dea0ed6f6deef1a0ae9d8f6bafea3225134
SSDEEP 384:E3pES+/xwGkRKJqOt9lM61qmTTMVF9/q5b40:fS+ZfbJqOHO8qYoAt
TLSH
T1CEB22A1FA78545F0EBD582301AAB16BEE576B862472986931B60FE0D1C31770E9373CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flash.log

Path \??\c:\windows\temp\flash.log
Size 14KB
SHA256 af3ee98d74b2630d6675634b597668045480262a7d6619c5983802093caaa42d
MD5 2057a8e7cbf6fd84436b6dd2960e7869
SHA1 3c61915741dd748bd8ef8cde14d8610eb917c0f7
SHA512 ef6c4945476c33cdc3f80d1d3a10e2a7bfb376ec6a1a37491d33dd98ca13156dffcaf3706c26d6455860f8cc1146a0fd7346324fce8e84ae42e6a63e3df53e1a
SSDEEP 384:bmV+EqeEAPJIaerZCBLZRGI+2BVCvqWQmODxvXDNDHMofcHLKg9SOo/gtx+zupB7:6YeEAPJIaerZCBLZRGI+2BVCvqWQmODE
TLSH
T1E6629641459E60EC6339D7963E178022E78D5542306EECD83EEE189CABF4B1CA7EB464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads