4007e03b994d2632a5211befb7adabbea969f298f8edb68f365abef216fff23b

General

Target
2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe
Size 24KB
Sample261023-mltvaaxwas
SHA256 4007e03b994d2632a5211befb7adabbea969f298f8edb68f365abef216fff23b
MD5 7acf9cd6da17d6f6b9ac3f29856d42fd
SHA1 188e38816be8f0ae056066a5da225cf164e8c160
SHA512 fb4bbdf6767ef124a39dd4d4410834094c2f83f89aa2e583df4f52664c91608dc5133965a388b056748d2ec0d20a488ad934a8586df83b57f52d40fc2cfa3e49
SSDEEP 384:E3eVES+/xwGkRKJgXlM61qmTTMVF9/q5C0:bGS+ZfbJCO8qYoAD
TLSH
T19BB2F91BA7C644F0EBA5C2301AAF1A7FD566BCA2472946971B10FF1D1C31260E9263CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5256	spoolsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2308	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1040	cmd.exe
2376	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4676	ipconfig.exe
3388	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	3388	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2472	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe
2472	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe
5256	spoolsv.exe
5256	spoolsv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1040	2472	2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe	88
PID 1040 wrote to memory of 2376	1040	cmd.exe	90
PID 1040 wrote to memory of 4676	1040	cmd.exe	91
PID 1040 wrote to memory of 2308	1040	cmd.exe	92
PID 1040 wrote to memory of 840	1040	cmd.exe	96
PID 840 wrote to memory of 1768	840	net.exe	97
PID 1040 wrote to memory of 3388	1040	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_7acf9cd6da17d6f6b9ac3f29856d42fd_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:4676
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      System Location Discovery: System Language Discovery
      PID:1768
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3388

C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe
"C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Program Files\Common Files\microsoft shared\Web Folders\1033\spoolsv.exe
Size 24KB
SHA256 5c24d25c0ef1d6f9513ae3d0b26f7e7ba8c0965792cc25b495354190732c0037
MD5 7ca144172dc0508c57aaca89c9ff9448
SHA1 ed928c9a956653f9afd0971f9d3ff5448bdce953
SHA512 e1342a0421a45db930707832f3887ec9029436faeff742d2edaade34ba827308b47d8a69d0a763b702a6678b8bd0f1a7d8997b0c01f4c3ff8e58c37237b3fa41
SSDEEP 384:E3eVES+/xwGkRKJZlM61qmTTMVF9/q5S0:bGS+ZfbJZO8qYoAz
TLSH
T133B2E91BA68544F1EBD5C2301ABB1ABEE966BC62472947971B20FF1D1C31360D9263CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flash.log

Path \??\c:\windows\temp\flash.log
Size 14KB
SHA256 e3802d2484505deb50ed5d5598c28267b371d3d93784e4bd87d9cce35f8ec960
MD5 d3e145601a674e0a7c37bf32189410be
SHA1 a842055ce72adacfe927818bac6e6a18b5750104
SHA512 948fba2b41115965f451df751b893f9e27c159343f23b379f6be6a3430cd435eb2b10708d070a4285030cb931db1ea67674bdb8f2e3e2998ae38595d56b97fd5
SSDEEP 384:SmV+s8wFPhz4DhNhuYH8JWP1BO4jEndNcFyy3p1Le/XCqRUSbCOVdfchsEgAknMr:RxFPhz4DhNhuYH2WNBO4jEndNcFyy3pp
TLSH
T1EF628581559F60EC6339D7952E178022E74E5502346EFCD83EDE049CABF4B1CABEB560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads