33e31c03f3b55c6ab37d56dc646a1dd8fad43cd542fbaa9b357deeccc185ed0b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_c9f008cbcde76a3825ca4ebb03d08a77_elex_mimic_pay2key_wannacry.exe
Size 15.5MB
Sample260702-2e52ascw2r
SHA256 33e31c03f3b55c6ab37d56dc646a1dd8fad43cd542fbaa9b357deeccc185ed0b
MD5 c9f008cbcde76a3825ca4ebb03d08a77
SHA1 c96007fd5a12bb11fd03b73ae80521f2c59944e6
SHA512 1cdd271422b969c4b45f29f9fb827290d18e75fb5c4fe97c3d90e34ef46a818b2f493ccf2bb02a873fd2c662cf0b561b469bf8b3dd94039cb07c701761ece314
SSDEEP 393216:Ug47JpNg7MoZjhlgve65QCJEnPIR38AvC8Cw4qtUYvRpjyE8VShwDtiPeHoGV6X:qQZwvX54PE8iC0DzjyLVShnPaoGQX
TLSH
T107F6339570FADDA9CC8365388089B363D8F2FB8FAF1486D772409E604D181DF9B35A85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	DXSETUP.exe

Loads dropped DLL 3 IoCs

pid	Process
3964	DXSETUP.exe
3964	DXSETUP.exe
3964	DXSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_c9f008cbcde76a3825ca4ebb03d08a77_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 3964	5636	2026-07-02_c9f008cbcde76a3825ca4ebb03d08a77_elex_mimic_pay2key_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_c9f008cbcde76a3825ca4ebb03d08a77_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_c9f008cbcde76a3825ca4ebb03d08a77_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DSETUP32.DLL
Size 1.6MB
SHA256 9db4910b99cfed2a5944303ac6ff0f609c335131c4ee3e75a1b4c61d3c1a6ce3
MD5 1d6b292da474d3f0f780664d6883257c
SHA1 5d85598505ab32331d2c880b03bf66af50f1eece
SHA512 b6d772e4606f9fd313134bd0d4120cb17f2c0ab27e36c255e9b5889b21faca987b9f255ba12d8f1eb7112b55aa2dafbceff19d4e12d45b5e03185f831b6f8fb7
SSDEEP 49152:9jxO/ZOOOOOOOOOOOOOOOOMiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXT:TCO
TLSH
T1A175AE35B1D40331E6B203B167128AB7F73EDBDDE21AD521B9AE82552186B8CC33E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
Size 516KB
SHA256 d6bcd10c6f9d9137189de9a9b9f76f033b8e5022129b710a9a3091116cd45ec5
MD5 2cfd505070ee1ae30c70f1cc8b4a3b23
SHA1 4762ff4ef24eba02c751c4a9d2027e0a754d9661
SHA512 6a3c119805d580e3d729f789b5cdce1febe061d0f437426b1189b0f4ba5aa5eacaffb3d1d114ec9275c9b6afd1903bf2b91afec6e03ba9f49a1dbf5fd24823f4
SSDEEP 3072:3i6LKeIXbJ8nUc2nDzw0FWtj/WM0PSQ5lbSN2LhaM96rKmMH2/5Mjt4zT1mFDYkV:xZ2nDzw0FWdwewUM1Ws4VfgJ
TLSH
T1DAB41C1067F99225F4F36B386A7913964E3ABE91DD38C55E6314319E4A31E80DE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dsetup.dll
Size 95KB
SHA256 5b4c9977c41f7c53c2574385e41c4c70bc407e48a9c9ac79c3a0964debb10f04
MD5 3a221f6a9e1a57dbb4724da320381d00
SHA1 86b9efe9e8c366512dfb787d254433fd62ea1671
SHA512 17ae3d57b9ac98d803d7a5534c4f62962c7f1969aa1cfa501bb6763fa94a2e1b212e139a368569d4141a7e2693e007407ab955e0765c58eaaa20cfa4a1aac678
SSDEEP 1536:SLtBqvGTWmOeR3+MPb3hzgS/1nJvMgqAlTJQs0MajclgUukW+j2c5o5INSkVg7XL:UtAvGymOA39b3h7/1CfWYcZ5x5o58Skg
TLSH
T172937D15BE50C072DCD120B916CCE7B1A6BEE1B00B2999C7B35447DAD9613C6AA3934F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads