2026-02-08_3f2cbe0a2a92fe5b25a8c68d1e7d69a1_elex_wannacry
WannaCry ransomware masquerading as Word
Office-masquerading WinInet loader self-deletes via hidden cmdRewrites executables across drives while preserving timestamps
SHA-2565a8a3eaf81c5c8162ee2109fcd96b975d0f0d0f9044f615aad6054bf7fa92c5b
Evidence
⋯5 more rows
0x229a45e86c0066c745ea330066c745ec3200E.l.f.E.3.f.E.2.
0x22aac645f053c645f168c645f265c645f36c.E.S.E.h.E.e.E.l
0x22bac645f46cc645f545c645f678c645f765.E.l.E.E.E.x.E.e
⋯11 more rows
⋯7 more rows
0x25a18065ff00508d45dc508d85d8faffff50.e..P.E.P......P
0x25b1c645dc63c645dd6dc645de64c645df20.E.c.E.m.E.d.E.
0x25c1c645e02fc645e163c645e220c645e370.E./.E.c.E. .E.p
0x25d1c645e469c645e56ec645e667c645e720.E.i.E.n.E.g.E.
0x25e1c645e831c645e932c645ea37c645eb2e.E.1.E.2.E.7.E..
0x25f1c645ec30c645ed2ec645ee30c645ef2e.E.0.E...E.0.E..
0x2601c645f031c645f120c645f22dc645f36e.E.1.E. .E.-.E.n
0x2611c645f420c645f531c645f626c645f764.E. .E.1.E.&.E.d
0x2621c645f865c645f96cc645fa20c645fb22.E.e.E.l.E. .E."
0x2631c645fc25c645fd73c645fe22e8b02800.E.%.E.s.E."..(.
0x26410083c40c8d85d8faffff6a0050ff15a0..........j.P...
⋯11 more rows
⋯7 more rows
0x57a60000000000009669000000000000cc00.......i........
0x57b646696e64436c6f73650068014765744cFindClose.h.GetL
0x57c66173744572726f720000da0046696e64astError....Find
0x57d64e65787446696c655700d30046696e64NextFileW...Find
0x57e6466972737446696c6557000047014765FirstFileW..G.Ge
0x57f6744469736b4672656553706163654578tDiskFreeSpaceEx
0x58065700de01476574566f6c756d65496e66W...GetVolumeInf
0x58166f726d6174696f6e57006e014765744cormationW.n.GetL
0x58266f676963616c4472697665537472696eogicalDriveStrin
0x58366773570000035365744572726f724d6fgsW...SetErrorMo
0x58466465000074014765744d6f64756c6546de..t.GetModuleF
0x5856696c654e616d655700003100436c6f73ileNameW..1.Clos
0x58666548616e646c65006600437265617465eHandle.f.Create
0x587650726f636573735700004a0043726561ProcessW..J.Crea
0x588674654469726563746f72795700006002teDirectoryW..`.
0x58964d6f766546696c655700a30252656164MoveFileW...Read
0x58a646696c650000060353657446696c6550File....SetFileP
0x58b66f696e74657200005200437265617465ointer..R.Create
0x58c646696c6557008b03577269746546696cFileW...WriteFil
0x58d665004c01476574447269766554797065e.L.GetDriveType
⋯13 more rows
0x59b66573730074024f70656e50726f636573ess.t.OpenProces
0x59c67300dd01476574566f6c756d65496e66s...GetVolumeInf
0x59d66f726d6174696f6e4100870250726f63ormationA...Proc
0x59e665737333324e65787457000046035465ess32NextW..F.Te
0x59f6726d696e61746550726f636573730000rminateProcess..
0x5a06850250726f6365737333324669727374..Process32First
0x5a1657006f00437265617465546f6f6c6865W.o.CreateToolhe
0x5a266c703332536e617073686f740000b403lp32Snapshot....
⋯6 more rows
0x5fe8726e6e421e74779fbda1426e39201d42rnnB.tw...Bn9 .B
0x5ff86ed13185d8bb857200000000b1324000n.1....r.....2@.
0x600800000000000000000000000000000000................
0x601800000000000000005c0000002e002e00........\.......
0x6028000000002e0000002a0000002d000000........*...-...
0x603842424231e8381962935a4a62bb864148BBB1.8.b.ZJb..AH
0x604815420b42ccb9adbf19005847feb854ac.B.B......XG..T.
0x605853822b682b5c64298207e56d751c4edaS.+h+\d)...mu.N.
0x6068d2b506546654a5923f5886c1644b8f72...TfT..?X..dK.r
0x60781b3f134e4c05caea2702d52906e5bc7c.?.NL...'..)...|
0x6088b80a53843aac18567170d15d8a310e3b..S.:..Vqp.].1.;
0x6098812954846778913d857fa78467a0a543.)T.gx.=....g..C
0x60a86465fb4fb98d48df4d8b8b3ea4715a02de.O..H.M..>.qZ.
0x60b838d0db64921dace17f7e01af30ad89548..d.....~..0..T
0x60c889d27e571df300004242424242424242..~W....BBBBBBBB
0x60d8584242425342422de4eedd478b1a0a1aXBBBSBB-...G....
0x60e8787d7c4ada5a29f9940c49f3afee2294x}|J.Z)...I...".
0x60f8bf86274486e2daa56f0d9ce92673ee61..'D....o...&s.a
0x61087ea6532ed664b8492fb334acaf9ef052~.S..d.I/.4....R
0x61183dba8e67f020e158fe7a4b1ceb3f1d60=..g. .X.zK..?.`
0x612899d9b5f68438d231c49bce093010ab35.....8.1....0..5
0x613899eab81a1cc136aef6ac2a425043e8be......6...*BPC..
0x6148f63074d66ed02f36ea239926f613863d.0t.n./6.#.&...=
0x615873daf887298bae47a0edfab3ec560000s...)..G.....V..
0x61680c4215420d4210420662bbda4662f126.B.B.B.B.b..Fb.&
0x6178464c42424242425d5bf661ad9ba9c565FLBBBBB][.a....e
0x61889370bb3a5aa40a75eaf96f2a6bb89ec8.p.:Z..u..o*k...
0x6198a8da52fd545e91e2c4139f53c3d59e83..R.T^.....S....
0x61a816e16325e8ba09abc15c39938f1f3eab..c%.....\9...>.
0x61b88d93d44290b94b48ef4e64bc15279cec...B..KH.Nd..'..
0x61c87d49b4f4a3b51b6e211436cd04c389da}I.....n!.6.....
0x61d822f1c4b4eb33ba61005644cb05e018be"....3.a.VD.....
0x61e895e68f2635b774439811b28ec84cae66...&5.tC.....L.f
⋯7 more rows
0x628c55386615c10e06523aaf000025007500U8f....R:...%.u.
0x629c00000000250073005c00250078002500....%.s.\.%.x.%.
0x62ac64000000250073005c00250030003800d...%.s.\.%.0.8.
0x62bc5800000077696e696e65742e646c6c00X...wininet.dll.
0x62cc75726c6d6f6e2e646c6c0000496e7465urlmon.dll..Inte
0x62dc726e65744f70656e41000000496e7465rnetOpenA...Inte
0x62ec726e6574436f6e6e6563744100000000rnetConnectA....
0x62fc487474704f70656e5265717565737441HttpOpenRequestA
0x630c000000004874747053656e6452657175....HttpSendRequ
0x631c65737441000000004874747051756572estA....HttpQuer
0x632c79496e666f410000496e7465726e6574yInfoA..Internet
0x633c5265616446696c65000000004f627461ReadFile....Obta
0x634c696e557365724167656e74537472696einUserAgentStrin
0x635c67000000496e7465726e6574436c6f73g...InternetClos
0x636c6548616e646c6500496e7465726e6574eHandle.Internet
0x637c5365744f7074696f6e57000048747470SetOptionW..Http
0x638c53656e64526571756573744578410000SendRequestExA..
0x639c48747470456e64526571756573744100HttpEndRequestA.
0x63ac00000000010000000000000000000000................
⋯12 more rows