Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
35 signatures
150 seconds
General
- Target 2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe
- Size 612KB
- Sample260928-e7engswvdy
- SHA256 98282df62818533708f02894eb7be2ec890abfbfe9095c4f590c505ad3434508
- MD5 74088e5a03a6f54809a202b803181e21
- SHA1 beb21cabbe06490739e3ebea5626c9ba459c13d8
- SHA512 f4e88c8dd3088d1fca576324ad4908262cdee12f3e55b2ad56ff0949611fc9bf6b398e001f023b597996e8f9b15fd467c756456b6192374d71e763214b6bcd36
- SSDEEP 12288:aXwOrReFWQQ4xcaybhcZn7hanlIiWBYU4l+KmQ9+:aXwOrRszPybhcZn7ONS4lQc+
- TLSH T147D412523BC188F5D19303B18D773BA38DBAEA7E0B1445C35BB438167A795C2A639387
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/files/0x00070000000243c9-10.dat UPX behavioral1/memory/3816-18-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/3816-37-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/3316-57-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-56-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-75-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-76-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-77-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-78-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-79-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-80-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-81-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-82-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-83-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-84-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-85-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-86-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-87-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-88-0x0000000000400000-0x00000000004CD000-memory.dmp UPX behavioral1/memory/1416-89-0x0000000000400000-0x00000000004CD000-memory.dmp UPX - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation 2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe - Executes dropped EXE 3 IoCs
pid Process 3816 dControl.exe 3316 dControl.exe 1416 dControl.exe - AutoIT Executable 18 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3816-37-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/3316-57-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-56-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-75-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-76-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-77-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-78-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-79-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-80-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-81-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-82-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-83-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-84-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-85-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-86-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-87-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-88-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral1/memory/1416-89-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe -
resource yara_rule behavioral1/files/0x00070000000243c9-10.dat upx behavioral1/memory/3816-18-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/3816-37-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/3316-57-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-56-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-75-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-76-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-77-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-78-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-79-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-80-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-81-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-82-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-83-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-84-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-85-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-86-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-87-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-88-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1416-89-0x0000000000400000-0x00000000004CD000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dControl.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3816 dControl.exe 3816 dControl.exe 3816 dControl.exe 3816 dControl.exe 3816 dControl.exe 3816 dControl.exe 3316 dControl.exe 3316 dControl.exe 3316 dControl.exe 3316 dControl.exe 3316 dControl.exe 3316 dControl.exe 1416 dControl.exe 1416 dControl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1416 dControl.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3816 dControl.exe Token: SeAssignPrimaryTokenPrivilege 3816 dControl.exe Token: SeIncreaseQuotaPrivilege 3816 dControl.exe Token: 0 3816 dControl.exe Token: SeDebugPrivilege 3316 dControl.exe Token: SeAssignPrimaryTokenPrivilege 3316 dControl.exe Token: SeIncreaseQuotaPrivilege 3316 dControl.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe 1416 dControl.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3344 wrote to memory of 3816 3344 2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /TI4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1416
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3s8i1a6q.tmp
- Size 37KB
- SHA256 a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79
- MD5 3bc9acd9c4b8384fb7ce6c08db87df6d
- SHA1 936c93e3a01d5ae30d05711a97bbf3dfa5e0921f
- SHA512 f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
- Size 447KB
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- MD5 58008524a6473bdf86c1040a9a9e39c3
- SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
- TLSH T1EBA42292D5045CD2D5174339DF7B7FF38EB6ADEE29180A8344B8387B3C3A9922158A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.ini
- Size 85KB
- SHA256 9d996a69d2be12673294e70426a76892d32b593c17d7761f4aab41d268672507
- MD5 15353a0d20e078f7ce05beaaf1b29836
- SHA1 5015663d40965c2d2d0ddf6ebe7531effbffbf78
- SHA512 3f911a5e0d6f3baca74880d282b27a0d6bcfe67a5654652805afc8f2041f6f4e3cef1794d20362b54704e7541ec5ba11d3a0f9fdc2f61b31299222357eb86882
- SSDEEP 768:s/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSrj:r+NyjsxkKdkJdULgbWSP
- TLSH T19E83021A92FA6219F2F39B10E6F41F720B36BD95693CD04C0ED55D8C19E0E609522BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\3s3i1a6q.tmp
- Size 37KB
- SHA256 557a903f0f2177e3e62b1a534dee554cf2eff3dd3991bc2310f064bf9c7d2152
- MD5 1f8c95b97229e09286b8a531f690c661
- SHA1 b15b21c4912267b41861fb351f192849cca68a12
- SHA512 0f0e5b85b6ef73ecebcd70ca90ce54c019eec1ea99966c469f357dd3393d0067f591b3690fe0b7922d7ba4aa25ebefd76a092d28c3377e6035720f8630a1a186
- SSDEEP 768:fpyiQinV1dixWkWGRKNXE6hW/bhbmXKOSmI6GAnFJguV8c2MOIqC6o4:hVQiV1dixWkWGRKNXE6hW/bh6KOS2GCe
- TLSH T17003CEB657E3D2C65E161084B59C0E9B0A7203761CEC2E15EF7EE9E44BC4B16F42D84E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\aut17C4.tmp
- Size 14KB
- SHA256 8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3
- MD5 9d5a0ef18cc4bb492930582064c5330f
- SHA1 2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8
- SHA512 1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4
- SSDEEP 384:Lc+oi65hxQuuaeawNT9vyk+8fYkjeXGsuojMExHixvLiH:Lvqxpkaw9oD0Jje2sZPxCxvGH
- TLSH T1A162BE8D3D193109F2A2A4D14B7197A06E1FCBD0794C67285F90C9366E72FB1B2E3227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\aut17D5.tmp
- Size 12KB
- SHA256 5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366
- MD5 efe44d9f6e4426a05e39f99ad407d3e7
- SHA1 637c531222ee6a56780a7fdcd2b5078467b6e036
- SHA512 8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63
- SSDEEP 384:cIbUPrMe4JQrf/GvefQ9Ruiwwyeq62BYZ:l+getDi9Cq2yZ
- TLSH T1EC42D1506C29AD2E63768D9D93A9E701ADB107D11140CD52B24337FA9E4A8CAF349C3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\aut17D6.tmp
- Size 7KB
- SHA256 9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5
- MD5 ecffd3e81c5f2e3c62bcdc122442b5f2
- SHA1 d41567acbbb0107361c6ee1715fe41b416663f40
- SHA512 7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76
- SSDEEP 192:IsyIiAhPheSUbYWJ/sktA3qM9snQWjljZ1hkDjuQ0C1yW:IBXAhPheSaYCEGAHaQWdmxrkW
- TLSH T1FDF1AE1C4A7099792F10A6273A9BD71921FF8EE74397E0A39450A79AF0E2389C648F44
- MD5 SHA1 SHA512 SSDEEP TLSH