Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 18:00
General
- Target 2026-09-13_0cedb549b165f43c4820a328dc421567_elex_wannacry.exe
- Size 11.2MB
- Sample260913-wlkfaatvds
- SHA256 adc6201e102c87be3ca7c6255b0b44c873dcadbfd9dc978090120543b7c3fcda
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 3 IoCs
- Creates new service(s) 2 TTPs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 9 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_0cedb549b165f43c4820a328dc421567_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_0cedb549b165f43c4820a328dc421567_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\KillDuplicate.cmd" "C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable" "2026-09-13_0cedb549b165f43c4820a328dc421567_elex_wannacry.exe""2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\WiseCare365Portable.exe"C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\WiseCare365Portable.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe create WiseBootAssistant binpath= "C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\App\WiseCare365\BootTime.exe" DisplayName= "Wise Boot Assistant" type= share start= auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\App\WiseCare365\WiseCare365.exe"C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\App\WiseCare365\WiseCare365.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\App\WiseCare365\BootTime.exeC:\Users\Admin\AppData\Local\Temp\WiseCare365Portable\App\WiseCare365\BootTime.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WiseCare365Portable.ini
appinfo.ini
CustomHead.Png
config.ini
config_tray.ini
WiseHDInfo32.dll
WiseRegNotify.sys
WiseCare365.reg
WiseHDInfo.reg
BootTime.exe
Arabic.ini
Azerbaijani(Latin).ini
Belarusian.ini
Bulgarian.ini
Catalan.ini
Chinese(Simplified).ini
Chinese(Traditional).ini
Croatian.ini
Czech.ini
Danish.ini
Dutch(Belgium).ini
Dutch(Nederlands).ini
English.ini
Finnish.ini
French.ini
Georgian.ini
German.ini
Greek.ini
Hebrew.ini
Hungarian.ini
Indonesian.ini
Italian.ini
Japanese.ini
Korean.ini
Kurdish.ini
Lithuanian.ini
Nepali.ini
Norwegian(Bokmal).ini
Norwegian(Nynorsk).ini
Persian.ini
Polish.ini
Portuguese(Brazil).ini
Portuguese(Portugal).ini
Romanian.ini
Russian.ini
Serbian(Cyrillic).ini
Skin.dll
WJSLib.dll
WiseCare365.exe
sqlite3.dll
WiseCare365Portable.exe
System.dll
UAC.dll
newadvsplash.dll
nsExec.dll
registry.dll
splash.gif
config.ini
memory/1120-0-0x0000000000400000-0x0000000000451000-memory.dmp
memory/3140-382-0x0000000000400000-0x0000000001748000-memory.dmp
memory/3140-384-0x0000000000400000-0x0000000001748000-memory.dmp
memory/3496-334-0x0000000000489000-0x000000000048B000-memory.dmp
memory/3496-335-0x0000000000400000-0x00000000004A9000-memory.dmp
memory/3496-336-0x0000000000400000-0x00000000004A9000-memory.dmp
memory/4304-299-0x0000000073C54000-0x0000000073C55000-memory.dmp
memory/4304-327-0x0000000006C20000-0x0000000006C83000-memory.dmp
memory/4304-381-0x0000000073C54000-0x0000000073C55000-memory.dmp