7de8b315edc4d253ddf90af4bc4e312afe60328b78d457cdf6e47bedb22f532c

General

Target
2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe
Size 60KB
Sample261027-ej7z5abs8q
SHA256 7de8b315edc4d253ddf90af4bc4e312afe60328b78d457cdf6e47bedb22f532c
MD5 e66f649ecd62144564d367b343204fb5
SHA1 44317b62374e5de7482d8e401ef450d5cc9eb732
SHA512 31a072d3cb3cb4de61fa4fcec4bcc7fe62ad8b130e45182022a1616a43d5591b827e28ca08a8de179ecde92109b17ab28a6134f07508063c4ff72b4d3f5d8d22
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwN404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLro/4/Clsrul
TLSH
T13A5319835BEE5CF2F7951231087C8BB9927B99D4950DBEEFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4224	w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe
3996	w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
5108	w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
220	wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
3556	w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
4716	wBC9B0968fA767v4b8629400867C41D224FFAl.exe
4672	w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe	w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
File created	C:\Windows\wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe	w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
File created	C:\Windows\w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe	wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
File created	C:\Windows\wBC9B0968fA767v4b8629400867C41D224FFAl.exe	w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
File created	C:\Windows\w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe	wBC9B0968fA767v4b8629400867C41D224FFAl.exe
File created	C:\Windows\w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe	2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe
File created	C:\Windows\w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe	w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe
4484	cmd.exe
468	cmd.exe
1280	cmd.exe
4380	cmd.exe
4600	cmd.exe
224	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wBC9B0968fA767v4b8629400867C41D224FFAl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4112	2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4224	w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe
Token: SeIncBasePriorityPrivilege	3996	w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
Token: SeIncBasePriorityPrivilege	5108	w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
Token: SeIncBasePriorityPrivilege	220	wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
Token: SeIncBasePriorityPrivilege	3556	w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
Token: SeIncBasePriorityPrivilege	4716	wBC9B0968fA767v4b8629400867C41D224FFAl.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4224	4112	2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe	92
PID 4112 wrote to memory of 1280	4112	2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe	93
PID 4224 wrote to memory of 3996	4224	w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe	94
PID 4224 wrote to memory of 4380	4224	w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe	95
PID 3996 wrote to memory of 5108	3996	w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe	98
PID 3996 wrote to memory of 4600	3996	w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe	99
PID 5108 wrote to memory of 220	5108	w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe	100
PID 5108 wrote to memory of 224	5108	w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe	101
PID 220 wrote to memory of 3556	220	wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe	102
PID 220 wrote to memory of 4496	220	wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe	103
PID 3556 wrote to memory of 4716	3556	w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe	104
PID 3556 wrote to memory of 4484	3556	w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe	105
PID 4716 wrote to memory of 4672	4716	wBC9B0968fA767v4b8629400867C41D224FFAl.exe	106
PID 4716 wrote to memory of 468	4716	wBC9B0968fA767v4b8629400867C41D224FFAl.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e66f649ecd62144564d367b343204fb5_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe
  C:\Windows\w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
    C:\Windows\w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
      C:\Windows\w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
        
        C:\Windows\wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
        
        C:\Windows\w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\wBC9B0968fA767v4b8629400867C41D224FFAl.exe
        
        C:\Windows\wBC9B0968fA767v4b8629400867C41D224FFAl.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe
        
        C:\Windows\w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WBC9B0~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W8789D~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\WAC0B0~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4496
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\W67F4A~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\W0292F~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\W348E7~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe

Path C:\Windows\w0292F0DFf0FE5v4f2d2A2988388491C06881l.exe
Size 60KB
SHA256 e8442ad07c3c843001880f7eecbc9a4d95d56a7dd83c7b3af0d026f8c4e8769f
MD5 2adfb2a160aaa606ca5cc35b50717b47
SHA1 c7fc575b3cb62c748b9c4fc21c857f39c613d142
SHA512 ff90a55a4c5893426bf41a5b03f276575608c16817f8ceaec4ed4ebc4432f4e86c05c14b8181386f50a5a6496a4827dcc373a0f3b0a926eb7f484979c9074a5b
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwp404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLro74/Clsrul
TLSH
T17D5319835BEE5CF2F7911231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe

Path C:\Windows\w28C0F243fB345v4fc1299F6860C0C91CC6C8l.exe
Size 60KB
SHA256 b1e35fbfcae6ba9c6538ec343bc5176d401f50bed809ad2420909eff17672f4c
MD5 7e27d5f90cdaed4ee415c096bba0fc05
SHA1 4922dd310877d23c4a029c8ce5cda5c7a9696388
SHA512 40d88837639652d7dcd8700be70647f1d49d525753e003782138518228b5ba8fe95479a4c689d316f8ab93016ff471c4ac0878c983d82ca02e473016b9d1f0e3
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqws404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLro64/Clsrul
TLSH
T1F95318835BEE5CF2F7951231087C8BB9927B99D4950EBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe

Path C:\Windows\w348E7EC0f200Fv48f12A40E8D8831BD15F98l.exe
Size 60KB
SHA256 9e3ebf43b2d81cd6a052618e988da6b45cf55d368f7d99839ad1b834db75fef8
MD5 dae75af67c9060508c1ef64c576adaef
SHA1 a944969c6d1f4b4eb8be315f1483e0998ce1d3f2
SHA512 4dc839a22c0e6cdbabbf47175910672e7aa4c805511c1518a99fcd6be86d2bde622bdc97a508f3341e0502436d1951b0d2858a1cdb05aafd2c2a989aa0e8bad8
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwg404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroO4/Clsrul
TLSH
T1AA5309835BEE5CF2F7951231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe

Path C:\Windows\w67F4AC88f56E0v4ead2B57684E27A9FC67F6l.exe
Size 60KB
SHA256 c5f61207af46572c20b0aa72ce1c05fc19cadddc2d29241745a6ceb3c235ee2c
MD5 61751844105c3f12366be8c11856ec5b
SHA1 f268ae3486482b9827a3a46fb5a3e32d08cf956c
SHA512 b68a469bb4640c28ff92ce78736dde14bcf7921126808104f31fd7c9d9d4c3c3f70b2f1d037e89c5da68ef45cd97a13e385a8d20e76118b1263dacac72330481
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwo404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroW4/Clsrul
TLSH
T1B45319835BEE5CF2F7951231087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe

Path C:\Windows\w8789DF8CfF41Fv45052BB238A00FF87BA935l.exe
Size 60KB
SHA256 2d85b530f05e358deebd0d7d82b215431fbda43dc2f223a4ade232b2e47655fb
MD5 e342ab512b9bd23b76f75868f5079210
SHA1 4d5805bf2afaeaab604697ee3913c42fcf37be7e
SHA512 2e14df289c9758b731d83f0ac2707a845d2cc8693690d870fe96772a52d815a5cc7c302c77ba92976b50e1c351887bd5cafa5512319cf678cd844b7cbc6a45fb
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwa404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLrow4/Clsrul
TLSH
T1835319835BEE5CF2F7951131087C8BB9927B99D4950DBEDFAB40CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe

Path C:\Windows\wAC0B0F92fC278v4dc428F088B835EAB777F5l.exe
Size 60KB
SHA256 e5661dcb4d847f7942a653e492707a4df74a243ee71a166a3ddcfd26cd970b82
MD5 cd39a7c2da506f3ef737aca165eff009
SHA1 f20435b8bed8aac03ff99f5bfed43208461734a4
SHA512 d65560a8881e17e03584bb2c0a29d73fe561b51110165b27dd48e7de4256b324c070111d29f328e5704c8289b90f3ece97061b65a15ea538f7d0c792c7927f7c
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw9404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroP4/Clsrul
TLSH
T1525319835BEE5CF2F7911131087C8BB9927B99D4950EBEDFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wBC9B0968fA767v4b8629400867C41D224FFAl.exe

Path C:\Windows\wBC9B0968fA767v4b8629400867C41D224FFAl.exe
Size 60KB
SHA256 8ce6119e5ef71e99b7a74701b389b0be7804da89263f3b0b5b32a24b42debfa5
MD5 37daffdfe0bac982ae4680062a7b30e6
SHA1 3cdbf1fa5586cd3e65c80fcc8ba542c3e3c0f3ac
SHA512 2b53448d04051c1d33d4cf4e0559ee2306c38cb0c552a55449fd62923654c581502531873f32f5c48fc7d32c2920c8399279cd0d3788bd3ef4d09cd86ca58257
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw2404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroc4/Clsrul
TLSH
T1115309835BEE5CF2F7951131087C8BB9927B99D4950DBEEFAB40CD544037292E93A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads