acc7546d059980eb6cdd2c40b1cd8c23e0f327f584247334646da69e2b3d372a

General

Target
2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe
Size 1.7MB
Sample260908-2vbgmaythz
SHA256 acc7546d059980eb6cdd2c40b1cd8c23e0f327f584247334646da69e2b3d372a
MD5 766a6aadc1aa32ecd691525772ad7805
SHA1 5497e64c3de9fbff92273165ed9a399dac2c487d
SHA512 6076d66422436c1a811614c41c3e310dad50adb4e5234876dbb8864f352eabb82301e05bb0032843e1e9df96703c6cc4ee567bfe407dee3ac055c473003222d4
SSDEEP 24576:5kbhLAO7oVuU9oyg3ms+0PzriRP1lWKOc3E2C22kBi2no4qNcpXYHbp:Q9oYUGyg2swdlJMMVoRcXYHbp
TLSH
T1C2851221664AD843E3A16070D055F7FC85217EF8DD6BD603E9F67DAFF0B9B01A90A260
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5052	eidolon.exe
876	2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe
2536	USBServers32.exe
2092	USBServers32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\USBServers32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\USBServers32.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3280	cmd.exe
5036	cmd.exe
5776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBServers32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 5052	4644	2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe	89
PID 4644 wrote to memory of 3280	4644	2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe	90
PID 4644 wrote to memory of 5036	4644	2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe	92
PID 5036 wrote to memory of 876	5036	cmd.exe	94
PID 5036 wrote to memory of 2536	5036	cmd.exe	95
PID 2536 wrote to memory of 5776	2536	USBServers32.exe	96
PID 5776 wrote to memory of 476	5776	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\eidolon.exe
  "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_766a6aadc1aa32ecd691525772ad7805_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
    "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:476

C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
1⤵
- Executes dropped EXE
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USBServers32.exe

Path C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
Size 54KB
SHA256 8f53ab3cd172f685568e0cbb51eb7dfd2389a5fe6aaf47d0aa7d823253e673ee
MD5 6428b1de8971e837926de5b464725f64
SHA1 19d7ce6fff617b790f9de7bf99406e61061f0594
SHA512 7938b01ce48bcdd3276c83f82fc71407d101f2e884b3f271a17fcf4c60af642faf57047edab97906351217f79847107757283af3fbfc3059cf4eb8e8d778d026
SSDEEP 768:nj27aTwKrJgJapOgV0jvQbtgDDM1MEprbhrCTyYrKjA70QkwWyit3JvsgZaphsL7:nj2AwKrSEqLQxK+oyEIXQ7+JLIzbPhwj
TLSH
T1D643D083BA8688E2C410357025977B32CA176FD25085F4A6EF31FDA0E4FF15A942DE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\Temp\tttbrozzz.bat
Size 598B
SHA256 ffe4fd56d76da5060397a4e077c3cdf9ee1aa2114f41a2e3f8245bf26d48932d
MD5 1f7e6a84b88d28143765d37c376e3dc0
SHA1 1535fc5cddc0c9cf7d50979b646249027aad6698
SHA512 d97dd9f30d30b6166542907f73e5850a261c27180d6ccacdadc9b8f61e8ca94bca9fda43fe0679c786a0664927061eb8587a2540da82d5e65a4924d7bd2c1981
TLSH
T1D5F0A8018179C7751420D1531BE66B1DD310A915EF69EF6007114509608480FBD7F102
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\Temp\tttdelzzz.bat
Size 313B
SHA256 f84305225a9cdc993ae877d6b9dabe04ceb6ef9d90e5beaadc2e8931084ae11b
MD5 363e437c58e9e7c0d495256012f9b255
SHA1 c4b2954981a689414cbb8b98e51ff62cfd59266d
SHA512 1a6951ce1bdaab2e82753dc31b47e520c3728468e8e2a39c9681805c414e2d5419fdb0d86f2b94410a16bdeb4f09f5b323b327c725c545cce84ba40efb323e32
TLSH
T124E07D5465B887565830E16367E62F19D304BB579E2BDBE50B124501948550E7C7E102
MD5 SHA1 SHA512 TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 1.2MB
SHA256 e01cb7ee3855b3762155d147e30d257665ad9e4eafa7a8d2b8ae70df1061fd37
MD5 235480a1d1c2d6ac78489a79b85eac11
SHA1 7adac6a0409d466d6361e8e26464d36a4290da4b
SHA512 5cf00d8b8bec4bda538de322edbb80e2077c93991ae701b0e654c2b2603f0495a4e499c727d4ee67edc927e811c2aaa701e7d4437f3c6153257a58634151ae7d
SSDEEP 12288:LUCmOXVM6TLxEONSKje0rkCTd8QWJWB6TTxobJh1LWchN:oCmOXVbLxEqSr0rfdWY6TTx6bhN
TLSH
T153458C266698C0E6E2678074C552D6FEE2B23C55C76186CB52E07EAB3F337951D3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads