Overview

overview

5

Static

static

1

2026-10-28...ry.exe

windows10-2004-x64

5

2026-10-28...ry.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_04ded3aed3e9382a77336e1485a4613f_elex_wannacry.exe
  • Size 12.6MB
  • Sample261030-necsvsyw4m
  • SHA256 69e19c02ef56f4c90cf21f2c3a8b7b813016b436be60ccca70ab2261fb4edfff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discovery

Malware Config

Signatures

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_04ded3aed3e9382a77336e1485a4613f_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_04ded3aed3e9382a77336e1485a4613f_elex_wannacry.exe"
    1⤵
    • Drops autorun.inf file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5568
    • C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\autorun.exe
      .\autorun.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5592
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4092
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E0
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5532

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DeleteIcon.btn
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Buttons\DeleteIcon.btn
          • Size 85KB
          • SHA256 5a96ada35914dcec0e4adb3c2152035495f58f762ca2d7f2211dd8707816952c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HomeIcon.btn
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Buttons\HomeIcon.btn
          • Size 76KB
          • SHA256 38e7d5c1048fcf946aaaab2456702bd4eebd8c94f22b22352fd8bc4924666d95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SupportFilesIcon.btn
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Buttons\SupportFilesIcon.btn
          • Size 24KB
          • SHA256 1494d0890baa4fdb684f197863658858fcc5932cbdd4e7f612002a99001c9ef2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          exitYellowBlue.btn
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Buttons\exitYellowBlue.btn
          • Size 23KB
          • SHA256 95a36dffecadb7200f428ced1495b73fb90c7d22d82ce2172061c14bd2406ebd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flat.btn
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Buttons\flat.btn
          • Size 2KB
          • SHA256 e74399a81c50a456cec040b8a6497a767d1fe2e1917980c7f883def981379373
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MainBackground.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\MainBackground.png
          • Size 171KB
          • SHA256 d099218de529a9c87cc0f224fbab5dd210ac948a68cc2560bdfd4e27cda7683c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PlugInUSBBackgroundHighlight.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\PlugInUSBBackgroundHighlight.png
          • Size 47KB
          • SHA256 6a1111557841f44f17a018f9c21c11a3a123aca21c9f5b09d2fb2df459a1d562
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          background2.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\background2.png
          • Size 108KB
          • SHA256 f0658cc660ad7d6351a8094a065eb08100b0d686a0d55ccf99aefd169c168792
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02Of03Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x1200bitmaps\Mask02Of03Back.png
          • Size 7KB
          • SHA256 66e5006065aa22ab8af2006e68fb2ed266ff32027af462c5c32071a1f14e673f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02of02.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x1200bitmaps\Mask02of02.png
          • Size 7KB
          • SHA256 e91125bb1684ce2ff42d5c104a8700304bcff0dc4f08f40642fcf2eaa2a3b735
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02of02Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x1200bitmaps\Mask02of02Back.png
          • Size 7KB
          • SHA256 8c99f409ad9115e2b38fa80019e9cd1f0fb11f9877e3116868bb69af5f929cba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask03Of03.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x1200bitmaps\Mask03Of03.png
          • Size 7KB
          • SHA256 7f653b71f3f38d4447440ee43b61aeae9aab4bc82aeb63b8de39fe946709f34e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask03Of03Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x1200bitmaps\Mask03Of03Back.png
          • Size 7KB
          • SHA256 a9881f3c6dcca629068559ddbeef1dd5c04a4cc6d03e43b10b234f9de3e24032
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02Of03.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x300bitmaps\Mask02Of03.png
          • Size 874B
          • SHA256 966260fdcdb85c38f6dbb90d6535fe3b92d670c8738931345d918c150df10666
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask02of02.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x300bitmaps\Mask02of02.png
          • Size 907B
          • SHA256 fb313585b2cd02e4290cdbaf0e9468e3a22bc2d052e95b140990c5278d0be6e3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask02of02Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x300bitmaps\Mask02of02Back.png
          • Size 824B
          • SHA256 6504b48f37cdbc6bab049a65fcd47d3bdea584cbe6b3ebfa1534d59891fc2a6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask03Of03.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x300bitmaps\Mask03Of03.png
          • Size 877B
          • SHA256 22f924ec5ee4e569850a3b233fa3ac4c81c50b8e6a4fdafe30556ddfcdfec4a6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask03Of03Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x300bitmaps\Mask03Of03Back.png
          • Size 819B
          • SHA256 5f0199007de705679acf6869dc183377e144450e2e2ad6e523f6feb26511439f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask02Of03Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x600bitmaps\Mask02Of03Back.png
          • Size 7KB
          • SHA256 656e44962a0a206df7d7f6070feeeea785daea6ea6fb7b41310d816290b3fe5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02of02.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x600bitmaps\Mask02of02.png
          • Size 7KB
          • SHA256 3f01e0749dfa917ba54b4b8eaeb5b298a500ae595177a36ce3add23ddc2c45ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02of02Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x600bitmaps\Mask02of02Back.png
          • Size 7KB
          • SHA256 e666724b919d388d352f4ac4c8473b59c421cfc8cbb919dbdb54fd028890956c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask03Of03.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x600bitmaps\Mask03Of03.png
          • Size 7KB
          • SHA256 87174f34d2a2c1acc0cfc6356a0176bbfe1509b53df527a31ed0f6aeb44f06f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask03Of03Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\300x600bitmaps\Mask03Of03Back.png
          • Size 7KB
          • SHA256 05199e55440522e18b59dfda6e3dc3985d764e80c709804e6c49b44065315403
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mask02Of03.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\600x600bitmaps\Mask02Of03.png
          • Size 1KB
          • SHA256 4483bbceb6e13dd8c09e762853407a50386f6c0299ce480e70732fd20821ea86
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask02of02.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\600x600bitmaps\Mask02of02.png
          • Size 1KB
          • SHA256 c4b111b155d3a59c66660964221c888bee582bd0dba910f2302046f9eddacb7b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask02of02Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\600x600bitmaps\Mask02of02Back.png
          • Size 1KB
          • SHA256 94cd46d05ab46e5e37f075fe848369521c18d74dfafc8bf3b52da7b8ef166afe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask03Of03.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\600x600bitmaps\Mask03Of03.png
          • Size 1KB
          • SHA256 2620c3745484a570c027d1ecc819b769375485919758229dc2b0bb7628c95f78
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mask03Of03Back.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Images\bitmaps\600x600bitmaps\Mask03Of03Back.png
          • Size 1KB
          • SHA256 f813bcf2cf02e54bee72712333c1ad2b4a12ff184b7ad2d4b4a07548b9d3ee26
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Wow64.lmd
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\Plugins\Wow64\Wow64.lmd
          • Size 252KB
          • SHA256 f52e5179501a6880380641387210c0a0d03518897084c00480381c9a0d402dce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          autorun.cdd
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\AutoPlay\autorun.cdd
          • Size 2.3MB
          • SHA256 d817d2bfd4421dc44af8de667c3f96e1f3677c927021627a787e7b0c50156817
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DXP01Install.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\Autoplay\DXP01Install.ini
          • Size 81B
          • SHA256 5691f2937258267fe87f1e0a8f07d607d82b5ae87f75365723de436c8c714d3f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DXP01_ENU.xml
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\Autoplay\Languages\DXP01_ENU.xml
          • Size 15KB
          • SHA256 7ad3c81dae329913c48444eecb1f13d013daddeaf699b04ebceac356aee524b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          autorun.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\autorun.exe
          • Size 6.2MB
          • SHA256 4623143e177aa1643f41169d5209c41c93e74a008818066f2d795234b822dd01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lua5.3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\lua5.3.dll
          • Size 395KB
          • SHA256 52c0c096764e2722819723e860900d1084a4fd3952735a10ca23e8ce36b53036
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxp01mon.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF7B.tmp\network\AMD64\dxp01mon.dll
          • Size 1.2MB
          • SHA256 438ffb7194d36de12dc249eace20aea889054f863d9cc40ed2c3087a62f75fa4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download