General
- Target 2026-11-13_4f4bc062c460a8d433f81143387dd528_elex_phorpiex_wannacry
- Size 37KB
- Sample261114-q92rkshv8y
- SHA256 38fd21c1392b14b85782b091cd6f70d1bd853171f7b5dde4fcd2006dde0fcbec
- MD5 4f4bc062c460a8d433f81143387dd528
- SHA1 20b8f4fb3575173408903878db9e09b2efe6670b
- SHA512 5a344acc1c9dd3ed661ea02a6075f0fb9c89405d8b0ac71451a01c41de490d6e84a67929586ed2b4467196a00f746a569b0278a95f02ef58364429e284bffa40
- SSDEEP 768:F/SNkb70fCuCMbKGmqDdBJ/useFQcPiPiPiPdhohohohohohohohohohohohohd:UkbgfCuCwNmqFeFLPiPiPiPdhohohohc
- TLSH T1AE03947DFEB10816F07384B822F666EB877EB8720641DACF6E5411411E325E1EAF0A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-13_4f4bc062c460a8d433f81143387dd528_elex_phorpiex_wannacry.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-11-13_4f4bc062c460a8d433f81143387dd528_elex_phorpiex_wannacry.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Extracted
-
phorphiex
-
http://185.215.113.8/
-
http://tsrv3.ru/
-
http://tsrv4.ws/
-
http://tsrv5.top/
-
http://tldrbox.top/
-
http://tldrhaus.top/
-
http://tldrzone.top/
-
http://worm.ws/
-
12sNWkfRAweJAAc3kw2cRAxcivya6jB6euAp7VVYQgq9Cbj1
-
1FGzLF98d6Uv7P4YH7J4FF4bU599qtZNSk
-
3JHbgxWSZzvG73eeMZuTvV8LaCwPaSwH5e
-
qpx7g2fyuwq48npc3mscuzr04z6knnkj0swcy4e0xj
-
XhWmmLwQr1TEACBVaz9uXxwd83bz4a5Kp9
-
DQzK3cvLHL51kPqXrFxKNzxNYrXtgTUsan
-
0x2F1A943E9a5c200BC685C0f0E30e8D617b75c9E6
-
LSmkLAiDT3acWcRB7VkYoi41DUoEixusix
-
rBph5FwQDLfmTdUY3McSCHHvPh5ffoW2LG
-
TPVRSFAS59sQwH9jDiqQLaeXhFRVEFurPQ
-
t1URDzZXrWRRL8C1tRqtibK9VBRNwpvpNU3
-
AXmdnTwZTtJihRwpd8HRQDEr6dEwXohGy9
-
bitcoincash:qpx7g2fyuwq48npc3mscuzr04z6knnkj0swcy4e0xj
-
4Aap1n942WybmwMtxXGVnUZsXhkhzBUU9QnkzN3m7Lyo8ohPFCxKAeLawZ5hCm9k16hEbbygxcsCrKRVnWhEfMESCN2tEoj
-
GBQOR5U76QPW4VRAETF37FHRTZNLMQS5I3SOCZMFK2ICJROOMKPWMKF4
-
bc1qlumv78ht05dzdjaffdltlnruwdhuj535cx9j4n
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.146 Safari/537.36
Targets
-
- Target 2026-11-13_4f4bc062c460a8d433f81143387dd528_elex_phorpiex_wannacry
- Size 37KB
- SHA256 38fd21c1392b14b85782b091cd6f70d1bd853171f7b5dde4fcd2006dde0fcbec
- MD5 4f4bc062c460a8d433f81143387dd528
- SHA1 20b8f4fb3575173408903878db9e09b2efe6670b
- SHA512 5a344acc1c9dd3ed661ea02a6075f0fb9c89405d8b0ac71451a01c41de490d6e84a67929586ed2b4467196a00f746a569b0278a95f02ef58364429e284bffa40
- SSDEEP 768:F/SNkb70fCuCMbKGmqDdBJ/useFQcPiPiPiPdhohohohohohohohohohohohohd:UkbgfCuCwNmqFeFLPiPiPiPdhohohohc
- TLSH T1AE03947DFEB10816F07384B822F666EB877EB8720641DACF6E5411411E325E1EAF0A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Phorphiex payload
Executes dropped EXE
Windows security bypass
Windows security modification
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1