1b4d050134f585fbb3028111226eeebdbfc55ebe24506f0338a3633bfeb96109

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_390aa2bdee48c52d8686565eaa6854ad_coinminer_elex_wannacry.exe
Size 203KB
Sample260702-2v9dnags3w
SHA256 1b4d050134f585fbb3028111226eeebdbfc55ebe24506f0338a3633bfeb96109
MD5 390aa2bdee48c52d8686565eaa6854ad
SHA1 378dbc10ab8ea1c289a6ffba7a232cdc36d5637b
SHA512 91621075d42e9cb6713698e5aa11b87d158cbff2ada84cdfb5f63286c529ab4e5ad572b62b3debbb87af7839f25474f772ac021d2afbcd78f2016ba636caf653
SSDEEP 6144:i9o7tHiKg02IwLgnIgM54aDLHx1zjqz4ppIOs:+AHiKgHRsT
TLSH
T14814F112FBD1C6FEE09205724D512BA695FDEB740718898797840E0F6F346C9DA2E38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 32 IoCs

pid	Process
1640	setup.exe.UpdateShell.exe
3112	e74c1683b5344fc6a82a5c30a8267ff6.exe
6072	1c1f8b44fcbb47ce84f2069f442abe58.exe
3568	f0257b0e9df44432bc6cc9f7f92fe6e5.exe
5716	76750492bcd44c699dd0ae2680e0e086.exe
2884	6715d025208e4038b226c4d4964466b0.exe
5812	c6d3df07d6ce4b6da6f247c257bc29a8.exe
1600	8df47f30b9b841a5879ce90fc9b2a6d8.exe
4716	f5a1c1ec50a34907becc24e02fb02363.exe
3716	528ba9d29164475b9cc3df3f715694aa.exe
4520	1f7672edf02a47ceb2f6b873f437f86d.exe
1908	948f349d90324590bbdd57656117b5ca.exe
260	b11454c011e7463b89d7b99fa9b4fdb9.exe
5856	1a16b18151234ca98e2ed88b8122a45c.exe
1396	81475b9213b04770939043f770deeb65.exe
2288	a6f36800bfe343548dbc3a32dee4f9d5.exe
4940	e74c1683b5344fc6a82a5c30a8267ff6.exe
5908	1c1f8b44fcbb47ce84f2069f442abe58.exe
5468	f0257b0e9df44432bc6cc9f7f92fe6e5.exe
5640	76750492bcd44c699dd0ae2680e0e086.exe
460	6715d025208e4038b226c4d4964466b0.exe
2376	c6d3df07d6ce4b6da6f247c257bc29a8.exe
1768	8df47f30b9b841a5879ce90fc9b2a6d8.exe
4452	f5a1c1ec50a34907becc24e02fb02363.exe
6096	528ba9d29164475b9cc3df3f715694aa.exe
1836	1f7672edf02a47ceb2f6b873f437f86d.exe
2276	948f349d90324590bbdd57656117b5ca.exe
2368	b11454c011e7463b89d7b99fa9b4fdb9.exe
2448	1a16b18151234ca98e2ed88b8122a45c.exe
5748	81475b9213b04770939043f770deeb65.exe
824	a6f36800bfe343548dbc3a32dee4f9d5.exe
4864	e74c1683b5344fc6a82a5c30a8267ff6.exe

Loads dropped DLL 2 IoCs

pid	Process
1640	setup.exe.UpdateShell.exe
1640	setup.exe.UpdateShell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5a1c1ec50a34907becc24e02fb02363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6f36800bfe343548dbc3a32dee4f9d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76750492bcd44c699dd0ae2680e0e086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	948f349d90324590bbdd57656117b5ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c1f8b44fcbb47ce84f2069f442abe58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6d3df07d6ce4b6da6f247c257bc29a8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f7672edf02a47ceb2f6b873f437f86d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6d3df07d6ce4b6da6f247c257bc29a8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	528ba9d29164475b9cc3df3f715694aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0257b0e9df44432bc6cc9f7f92fe6e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76750492bcd44c699dd0ae2680e0e086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	948f349d90324590bbdd57656117b5ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_390aa2bdee48c52d8686565eaa6854ad_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81475b9213b04770939043f770deeb65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6f36800bfe343548dbc3a32dee4f9d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e74c1683b5344fc6a82a5c30a8267ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	528ba9d29164475b9cc3df3f715694aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e74c1683b5344fc6a82a5c30a8267ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0257b0e9df44432bc6cc9f7f92fe6e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5a1c1ec50a34907becc24e02fb02363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f7672edf02a47ceb2f6b873f437f86d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b11454c011e7463b89d7b99fa9b4fdb9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b11454c011e7463b89d7b99fa9b4fdb9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a16b18151234ca98e2ed88b8122a45c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe.UpdateShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e74c1683b5344fc6a82a5c30a8267ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6715d025208e4038b226c4d4964466b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8df47f30b9b841a5879ce90fc9b2a6d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a16b18151234ca98e2ed88b8122a45c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8df47f30b9b841a5879ce90fc9b2a6d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81475b9213b04770939043f770deeb65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c1f8b44fcbb47ce84f2069f442abe58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6715d025208e4038b226c4d4964466b0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	setup.exe.UpdateShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3104	2026-07-02_390aa2bdee48c52d8686565eaa6854ad_coinminer_elex_wannacry.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1640	3104	2026-07-02_390aa2bdee48c52d8686565eaa6854ad_coinminer_elex_wannacry.exe	88
PID 1640 wrote to memory of 3112	1640	setup.exe.UpdateShell.exe	89
PID 1640 wrote to memory of 6072	1640	setup.exe.UpdateShell.exe	91
PID 1640 wrote to memory of 3568	1640	setup.exe.UpdateShell.exe	93
PID 1640 wrote to memory of 5716	1640	setup.exe.UpdateShell.exe	95
PID 1640 wrote to memory of 2884	1640	setup.exe.UpdateShell.exe	97
PID 1640 wrote to memory of 5812	1640	setup.exe.UpdateShell.exe	99
PID 1640 wrote to memory of 1600	1640	setup.exe.UpdateShell.exe	101
PID 1640 wrote to memory of 4716	1640	setup.exe.UpdateShell.exe	103
PID 1640 wrote to memory of 3716	1640	setup.exe.UpdateShell.exe	105
PID 1640 wrote to memory of 4520	1640	setup.exe.UpdateShell.exe	107
PID 1640 wrote to memory of 1908	1640	setup.exe.UpdateShell.exe	109
PID 1640 wrote to memory of 260	1640	setup.exe.UpdateShell.exe	111
PID 1640 wrote to memory of 5856	1640	setup.exe.UpdateShell.exe	113
PID 1640 wrote to memory of 1396	1640	setup.exe.UpdateShell.exe	115
PID 1640 wrote to memory of 2288	1640	setup.exe.UpdateShell.exe	117
PID 1640 wrote to memory of 4940	1640	setup.exe.UpdateShell.exe	119
PID 1640 wrote to memory of 5908	1640	setup.exe.UpdateShell.exe	121
PID 1640 wrote to memory of 5468	1640	setup.exe.UpdateShell.exe	123
PID 1640 wrote to memory of 5640	1640	setup.exe.UpdateShell.exe	125
PID 1640 wrote to memory of 460	1640	setup.exe.UpdateShell.exe	127
PID 1640 wrote to memory of 2376	1640	setup.exe.UpdateShell.exe	129
PID 1640 wrote to memory of 1768	1640	setup.exe.UpdateShell.exe	131
PID 1640 wrote to memory of 4452	1640	setup.exe.UpdateShell.exe	133
PID 1640 wrote to memory of 6096	1640	setup.exe.UpdateShell.exe	135
PID 1640 wrote to memory of 1836	1640	setup.exe.UpdateShell.exe	137
PID 1640 wrote to memory of 2276	1640	setup.exe.UpdateShell.exe	139
PID 1640 wrote to memory of 2368	1640	setup.exe.UpdateShell.exe	141
PID 1640 wrote to memory of 2448	1640	setup.exe.UpdateShell.exe	143
PID 1640 wrote to memory of 5748	1640	setup.exe.UpdateShell.exe	145
PID 1640 wrote to memory of 824	1640	setup.exe.UpdateShell.exe	147
PID 1640 wrote to memory of 4864	1640	setup.exe.UpdateShell.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-07-02_390aa2bdee48c52d8686565eaa6854ad_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_390aa2bdee48c52d8686565eaa6854ad_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe.UpdateShell.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe.UpdateShell.exe" --no-update
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe
    "C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe" {EDA3C075-E9BA-4CD9-87EF-8A7B19F8D656}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\cc3aee3049514814bbbc2acf7e1ec6dd\1c1f8b44fcbb47ce84f2069f442abe58.exe
    "C:\Users\Admin\AppData\Local\Temp\cc3aee3049514814bbbc2acf7e1ec6dd\1c1f8b44fcbb47ce84f2069f442abe58.exe" {3A9FC03D-C685-4831-94CF-4EDFD3749497}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6072
- - C:\Users\Admin\AppData\Local\Temp\aabf5e8d9fb4448ea36f312e5d148102\f0257b0e9df44432bc6cc9f7f92fe6e5.exe
    "C:\Users\Admin\AppData\Local\Temp\aabf5e8d9fb4448ea36f312e5d148102\f0257b0e9df44432bc6cc9f7f92fe6e5.exe" {D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\b9dd55714bdb4696b260f652e91a9a82\76750492bcd44c699dd0ae2680e0e086.exe
    "C:\Users\Admin\AppData\Local\Temp\b9dd55714bdb4696b260f652e91a9a82\76750492bcd44c699dd0ae2680e0e086.exe" {7AC8EF88-D996-4D47-B40C-4DD93E307481}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\3cfa510bb1ee4651a98b1fa076f02da3\6715d025208e4038b226c4d4964466b0.exe
    "C:\Users\Admin\AppData\Local\Temp\3cfa510bb1ee4651a98b1fa076f02da3\6715d025208e4038b226c4d4964466b0.exe" {A4E269C1-168D-40D3-9ABD-57FE4D4DB537} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\2518f57b6daf493fa32aa9ce2825fe44\c6d3df07d6ce4b6da6f247c257bc29a8.exe
    "C:\Users\Admin\AppData\Local\Temp\2518f57b6daf493fa32aa9ce2825fe44\c6d3df07d6ce4b6da6f247c257bc29a8.exe" {296E293F-C481-4DDE-9ED2-3F79FCF38731}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5812
- - C:\Users\Admin\AppData\Local\Temp\dc877aae8839497f9cec3c4d389eb1c6\8df47f30b9b841a5879ce90fc9b2a6d8.exe
    "C:\Users\Admin\AppData\Local\Temp\dc877aae8839497f9cec3c4d389eb1c6\8df47f30b9b841a5879ce90fc9b2a6d8.exe" {BA035DEA-E9C0-429A-95D6-1986C12142DC} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\6b01067690ef4a66b43d86d0e7efa09e\f5a1c1ec50a34907becc24e02fb02363.exe
    "C:\Users\Admin\AppData\Local\Temp\6b01067690ef4a66b43d86d0e7efa09e\f5a1c1ec50a34907becc24e02fb02363.exe" {77610794-D144-422E-82B2-77BBE9052FDA}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\d000a7837de34bc5a3e13f32df72d0c3\528ba9d29164475b9cc3df3f715694aa.exe
    "C:\Users\Admin\AppData\Local\Temp\d000a7837de34bc5a3e13f32df72d0c3\528ba9d29164475b9cc3df3f715694aa.exe" {1391A7DF-8A20-44C0-A4D8-0D23DDA1C627} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\092c48b8454d4cdea001c16932a67458\1f7672edf02a47ceb2f6b873f437f86d.exe
    "C:\Users\Admin\AppData\Local\Temp\092c48b8454d4cdea001c16932a67458\1f7672edf02a47ceb2f6b873f437f86d.exe" {77610794-D144-422E-82B2-77BBE9052FDA}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\0897e93e5380433c91d4d0f138b0b22a\948f349d90324590bbdd57656117b5ca.exe
    "C:\Users\Admin\AppData\Local\Temp\0897e93e5380433c91d4d0f138b0b22a\948f349d90324590bbdd57656117b5ca.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\9c30250c0fc44162a2e275498e6866c0\b11454c011e7463b89d7b99fa9b4fdb9.exe
    "C:\Users\Admin\AppData\Local\Temp\9c30250c0fc44162a2e275498e6866c0\b11454c011e7463b89d7b99fa9b4fdb9.exe" "Wolfman Agent Service" 2.1.4.63
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:260
- - C:\Users\Admin\AppData\Local\Temp\1ed4b6a235eb4adb92c6cc5cf1e0e31b\1a16b18151234ca98e2ed88b8122a45c.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed4b6a235eb4adb92c6cc5cf1e0e31b\1a16b18151234ca98e2ed88b8122a45c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5856
- - C:\Users\Admin\AppData\Local\Temp\be944874f76d423d84927ebd7f69ce85\81475b9213b04770939043f770deeb65.exe
    "C:\Users\Admin\AppData\Local\Temp\be944874f76d423d84927ebd7f69ce85\81475b9213b04770939043f770deeb65.exe" -dataroot:Sync\Prod -environment:Prod -salesgroup:2
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\624a067cc0c8498cb9a86a423d113d06\a6f36800bfe343548dbc3a32dee4f9d5.exe
    "C:\Users\Admin\AppData\Local\Temp\624a067cc0c8498cb9a86a423d113d06\a6f36800bfe343548dbc3a32dee4f9d5.exe" "Order Tool"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe
    "C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe" {EDA3C075-E9BA-4CD9-87EF-8A7B19F8D656}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\cc3aee3049514814bbbc2acf7e1ec6dd\1c1f8b44fcbb47ce84f2069f442abe58.exe
    "C:\Users\Admin\AppData\Local\Temp\cc3aee3049514814bbbc2acf7e1ec6dd\1c1f8b44fcbb47ce84f2069f442abe58.exe" {3A9FC03D-C685-4831-94CF-4EDFD3749497}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\aabf5e8d9fb4448ea36f312e5d148102\f0257b0e9df44432bc6cc9f7f92fe6e5.exe
    "C:\Users\Admin\AppData\Local\Temp\aabf5e8d9fb4448ea36f312e5d148102\f0257b0e9df44432bc6cc9f7f92fe6e5.exe" {D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\b9dd55714bdb4696b260f652e91a9a82\76750492bcd44c699dd0ae2680e0e086.exe
    "C:\Users\Admin\AppData\Local\Temp\b9dd55714bdb4696b260f652e91a9a82\76750492bcd44c699dd0ae2680e0e086.exe" {7AC8EF88-D996-4D47-B40C-4DD93E307481}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\3cfa510bb1ee4651a98b1fa076f02da3\6715d025208e4038b226c4d4964466b0.exe
    "C:\Users\Admin\AppData\Local\Temp\3cfa510bb1ee4651a98b1fa076f02da3\6715d025208e4038b226c4d4964466b0.exe" {A4E269C1-168D-40D3-9ABD-57FE4D4DB537} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:460
- - C:\Users\Admin\AppData\Local\Temp\2518f57b6daf493fa32aa9ce2825fe44\c6d3df07d6ce4b6da6f247c257bc29a8.exe
    "C:\Users\Admin\AppData\Local\Temp\2518f57b6daf493fa32aa9ce2825fe44\c6d3df07d6ce4b6da6f247c257bc29a8.exe" {296E293F-C481-4DDE-9ED2-3F79FCF38731}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\dc877aae8839497f9cec3c4d389eb1c6\8df47f30b9b841a5879ce90fc9b2a6d8.exe
    "C:\Users\Admin\AppData\Local\Temp\dc877aae8839497f9cec3c4d389eb1c6\8df47f30b9b841a5879ce90fc9b2a6d8.exe" {BA035DEA-E9C0-429A-95D6-1986C12142DC} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\6b01067690ef4a66b43d86d0e7efa09e\f5a1c1ec50a34907becc24e02fb02363.exe
    "C:\Users\Admin\AppData\Local\Temp\6b01067690ef4a66b43d86d0e7efa09e\f5a1c1ec50a34907becc24e02fb02363.exe" {77610794-D144-422E-82B2-77BBE9052FDA}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\d000a7837de34bc5a3e13f32df72d0c3\528ba9d29164475b9cc3df3f715694aa.exe
    "C:\Users\Admin\AppData\Local\Temp\d000a7837de34bc5a3e13f32df72d0c3\528ba9d29164475b9cc3df3f715694aa.exe" {1391A7DF-8A20-44C0-A4D8-0D23DDA1C627} x64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\092c48b8454d4cdea001c16932a67458\1f7672edf02a47ceb2f6b873f437f86d.exe
    "C:\Users\Admin\AppData\Local\Temp\092c48b8454d4cdea001c16932a67458\1f7672edf02a47ceb2f6b873f437f86d.exe" {77610794-D144-422E-82B2-77BBE9052FDA}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\0897e93e5380433c91d4d0f138b0b22a\948f349d90324590bbdd57656117b5ca.exe
    "C:\Users\Admin\AppData\Local\Temp\0897e93e5380433c91d4d0f138b0b22a\948f349d90324590bbdd57656117b5ca.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2276
- - C:\Users\Admin\AppData\Local\Temp\9c30250c0fc44162a2e275498e6866c0\b11454c011e7463b89d7b99fa9b4fdb9.exe
    "C:\Users\Admin\AppData\Local\Temp\9c30250c0fc44162a2e275498e6866c0\b11454c011e7463b89d7b99fa9b4fdb9.exe" "Wolfman Agent Service" 2.1.4.63
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\1ed4b6a235eb4adb92c6cc5cf1e0e31b\1a16b18151234ca98e2ed88b8122a45c.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed4b6a235eb4adb92c6cc5cf1e0e31b\1a16b18151234ca98e2ed88b8122a45c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\be944874f76d423d84927ebd7f69ce85\81475b9213b04770939043f770deeb65.exe
    "C:\Users\Admin\AppData\Local\Temp\be944874f76d423d84927ebd7f69ce85\81475b9213b04770939043f770deeb65.exe" -dataroot:Sync\Prod -environment:Prod -salesgroup:2
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5748
- - C:\Users\Admin\AppData\Local\Temp\624a067cc0c8498cb9a86a423d113d06\a6f36800bfe343548dbc3a32dee4f9d5.exe
    "C:\Users\Admin\AppData\Local\Temp\624a067cc0c8498cb9a86a423d113d06\a6f36800bfe343548dbc3a32dee4f9d5.exe" "Order Tool"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe
    "C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe" {EDA3C075-E9BA-4CD9-87EF-8A7B19F8D656}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

948f349d90324590bbdd57656117b5ca.exe

Path C:\Users\Admin\AppData\Local\Temp\0897e93e5380433c91d4d0f138b0b22a\948f349d90324590bbdd57656117b5ca.exe
Size 5KB
SHA256 f912a2921f1b6b0e2ea8b839726dbd98d518c5873d41a1c3d704d47bfc9b2beb
MD5 9f57576567c04ef36ea2005285d34c38
SHA1 c8e3afdad77eed426dfa65e639d7d18d27db30bb
SHA512 8da38561bf36a24e2e114b36fb1f4860026c18a74f3311dd57cd118e38893b121a656024ab14ffab8a68e2ba7d3f661ec8c4d1ff212ab97d9b5e26a8c3588000
SSDEEP 48:61lHtZutfik3cmc573JqiWuJfRg4FtKUgJvPiHApC6tatdoMlMuQFWSfbNtm:AZuhcmcZZqERwUg9sApZta/RqXzNt
TLSH
T1D6C1B70163E8873AFC7787B07DB26A1102B5F761C857D76E584D431EAE322114A23F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f7672edf02a47ceb2f6b873f437f86d.exe

Path C:\Users\Admin\AppData\Local\Temp\092c48b8454d4cdea001c16932a67458\1f7672edf02a47ceb2f6b873f437f86d.exe
Size 7KB
SHA256 b425b46ff463ef6e733046570f2773b9c8942959be7d8446dfa383badceab653
MD5 ed0b975a1310917aa8fa4c9fd3d99105
SHA1 1160d45900155fec6475a9f41dc5b67fdaaa0d4f
SHA512 89c5f5ca31446add103cfaea52a65196387424fceca9e36f2217645777051e459f4f48d1b6ffb7a38d379dca62a7637323d9b565d7a3efc92f0cd4d77b0f1bbb
SSDEEP 96:Bo0HjVjK7pZomZU+WJRNvg/mhwuh5Uzk/d0ieiAujQinZlnf17non4zNt:Boehj2XZsRN4+GuIzk/1d19
TLSH
T188E1B504D3E84B32ECB64B75BC72A3501279FF01CCE3E75F55A9920B68326088922B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a16b18151234ca98e2ed88b8122a45c.exe

Path C:\Users\Admin\AppData\Local\Temp\1ed4b6a235eb4adb92c6cc5cf1e0e31b\1a16b18151234ca98e2ed88b8122a45c.exe
Size 6KB
SHA256 b7104a26c1348af8daf4c0d4967f8858f2d3b8a3202216172de4b6bd1c4dc230
MD5 dd7167e0ef9dabadd181c9192a3e3248
SHA1 f0a97ebca02233da165d54c3b4616e02fc5fbbc0
SHA512 6cf6b82427bd02f993af9659b930e6a43e984bff725bd2be4432bf906950cade0efa62d3aa2c5e30f5b4a33726db65f7952691a458b1b1a7ee510c6bbfeca3bb
SSDEEP 96:UUsXln4lXDWgwVhoh8K/ft7TZc3+XGXD0tzNt:Uf4Tb22B7TaXM
TLSH
T1CCD15E00A7E44772FCB20F36BC3762416678FB518D63DB4E7485825AAC373698622B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6f36800bfe343548dbc3a32dee4f9d5.exe

Path C:\Users\Admin\AppData\Local\Temp\624a067cc0c8498cb9a86a423d113d06\a6f36800bfe343548dbc3a32dee4f9d5.exe
Size 7KB
SHA256 3936f9f7856cacacc051bba288940817254b598cdef9cadd31b609c722f4b324
MD5 52133db7c2164f6258c97f43da5f9a16
SHA1 bef08d760be6fcea7c33cb10df9afc4b25189264
SHA512 b3018656d7628fac2c338ee4d3342a46b05ac1968608601543a8b1e30ddb2cc1f4daed0db06c494fda9c9cbdef1bef9a1d3ae9e1e482c5e5c74d227ab2b1249a
SSDEEP 96:t3tY6a8QximIP0x+Zo+SRNvgGLhtOhkU7/9RO1griWNyhagoOpzNt:ltRCimI/Z+RN4qmF7/94zWNgF
TLSH
T1D0E1A540E7E88636E9B20B72AC3267E14775FB118D63D74F59D5824A2A32294C672B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CallawayUpdate.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CallawayUpdate.Core.dll
Size 31KB
SHA256 18acb40e9bafccaf19c07084bb820ecb62526ea081ab9228b65353e8dcd88754
MD5 cf15e9c70cbcf6028f9e33ff168befd8
SHA1 0c729873e71e2957c1659844714b9798c0b55209
SHA512 dd2ec2ad2850ae10dca997a955b6ee1d25202c16442440c3a68afc10eca25841ecc90206a66d5c4b9af74308ca494e59ef15e9b50c258b3ed2a3300b2e2cf465
SSDEEP 384:h7wQeJV2IvGjvTjzkN9NZm8I76mVCXlk9dL/Eq6lUa+Sqm9TVWM5F9zAOnEhYv9Q:WwPoPK5dLcrPl9d5Jx2
TLSH
T1D2E25B0523E8CB68D67F47B45834C1108376F905AA13F35E9FE960AE29B73A4C5287B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.UpdateShell.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe.UpdateShell.exe
Size 144KB
SHA256 5d992efd261017111d246e95be58c9fd2d5b7602de21222864cea0589973d7b5
MD5 bf68205984a6b4b5b15b3489dcaaba75
SHA1 0bbc3d43596e3ac84ed6888e76ec9ea1d3b92e3b
SHA512 3ecdf2f3379315a699266f696448dd3e3123bf4ab9738143403b3edf0de2093ef4b688ec6632d69e0152073535ea52f07bacc41eef99a3e75a0c943a2d94644f
SSDEEP 3072:I60xoI7O2eTa6gEMkfHdBXPqZpqIaEdInNOjZAuq7vsjhqIaEdInF+:goI7O2e23sfHdBCZDONOnOF+
TLSH
T1EBE3CF01BB688060C9664B346CA6D9B0033DBE17BA5B870A7798364FAFF7352C5117E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.UpdateShell.manifest

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe.UpdateShell.manifest
Size 150KB
SHA256 e203ba2ee8e96bcf29d7ef4b5e15bbb60c10d998e43c134cc676c63d82c6b624
MD5 0d88353888a0a63b25a66a454227dc69
SHA1 f4b08e5246c8eb39461f307e8c49bf3804153e40
SHA512 9186bb267ebe25511d7e03161a7b478383c8e56f69cd6e7990a6291903f41cc52a310f37c5e821dc9220a7692442db87d0d52543921ad7fb961558ca5827feae
SSDEEP 1536:rbJLOden9dZRLLdtCkcLheb0o4n4j4x4g4X4v4N4C4/wFLGye1:rbb5jwktH4n4j4x4g4X4v4N4C4YUJ
TLSH
T16CE318768EA2FDD06B3E7890D40439921C893E5B6375466CFE8C04A61BD6540DF0FABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b11454c011e7463b89d7b99fa9b4fdb9.exe

Path C:\Users\Admin\AppData\Local\Temp\9c30250c0fc44162a2e275498e6866c0\b11454c011e7463b89d7b99fa9b4fdb9.exe
Size 9KB
SHA256 5b4493d33e96eb0a54ba513bde3b6cb91fb01f936ceba7f10dc2fe4517707ee1
MD5 2b56028b6cb959c627e18706f5f6b0eb
SHA1 4f979d59a9eb24c892d4887cbd26f63f5075f587
SHA512 a1b49bbccd6d967d9e7f9967f1c0ece2b728d12c1f2c54b952fe7629bff58c5c628fe6bb779e130a1650b0a31a2e47f984b1e2c51803bd3eefc202b91e9f722e
SSDEEP 96:RQnOQJxiFq8D+Zo+baRxvgGLhtYhkUsip4qhnj06a1qNuHb3ojWNta1FYcHemYsZ:RG/iFcZCRx4qQFlGCNQRszYcHe+Z
TLSH
T15612FA00C3F84732EAB347B63C3256529736F7534C97A75EB88C825A6F72A44D523A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e74c1683b5344fc6a82a5c30a8267ff6.exe

Path C:\Users\Admin\AppData\Local\Temp\b8db30c3b7f84d06bbfc9f9450f10373\e74c1683b5344fc6a82a5c30a8267ff6.exe
Size 6KB
SHA256 89a3ae61eb86ad65f3e4ccd8dfb53a70e1f3d5e722a73a653016c2712d8fb67c
MD5 3b899896deac1557a493c55e8d8939e8
SHA1 c6e6e5382ed5cf74d395e47c5d99a9ee05b2d3f0
SHA512 accc56ba4a6150a0b563a04cb5ded09895c0dc4d9d2c82b558143f421855cb4c388f445cbeb54c7748d8f52acde9a41dae78a8c1b718500896894cddee1fad3d
SSDEEP 96:o4mZnvXzkLo+Zk+TrRNgx1hah1JE91L9an8a6Q3hggo7zNt:obIPZXRKP4K91L9aGge
TLSH
T1DBD1B708E7E44337FD770772AC325BE063B1FB118CA7D65E5585822A6D363558622B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81475b9213b04770939043f770deeb65.exe

Path C:\Users\Admin\AppData\Local\Temp\be944874f76d423d84927ebd7f69ce85\81475b9213b04770939043f770deeb65.exe
Size 13KB
SHA256 0475aff7411072c77cb490e8edef2669fa2c8bd65ed143b0d98a718cb2748df2
MD5 10e79fc7e798b1a69bfb020baccfef24
SHA1 0f244941af568b4b220bae37fe246706e9b4b31e
SHA512 50a0099a6acf3e6c2b9a2270a457eb18c7094062a51f2cb92221f00ac11bb0c901bdabf43dbb6db4f64f0f704be9e2585dfc1922f691d63450c09cd4c9d6aab7
SSDEEP 192:GX/686RuDsr6Ga4nVEfZuRtRZkY/Y1VLnon1TrxY1YP9ShfuSU:GPjeVtbkH1VLorh9ShfuS
TLSH
T13E520A09E7F84B36EDBB0FB4BC716E200771F7426922D66E8B98514A5C33B048C52B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-91-0x0000000000F20000-0x0000000000F28000-memory.dmp

Download

memory/1396-103-0x0000000000170000-0x000000000017A000-memory.dmp

Download

memory/1640-24-0x00000000092A0000-0x00000000092DE000-memory.dmp

Download

memory/1640-18-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/1640-129-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/1640-29-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/1640-128-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/1640-25-0x0000000009270000-0x000000000927E000-memory.dmp

Download

memory/1640-23-0x00000000068C0000-0x00000000068CE000-memory.dmp

Download

memory/1640-19-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/1640-127-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/1640-125-0x0000000073952000-0x0000000073953000-memory.dmp

Download

memory/1640-17-0x0000000000CB0000-0x0000000000CDA000-memory.dmp

Download

memory/1640-16-0x0000000073952000-0x0000000073953000-memory.dmp

Download

memory/1908-85-0x0000000000C80000-0x0000000000C88000-memory.dmp

Download

memory/2288-109-0x0000000000210000-0x0000000000218000-memory.dmp

Download

memory/3112-33-0x0000000000960000-0x0000000000968000-memory.dmp

Download

memory/4520-79-0x0000000000B40000-0x0000000000B48000-memory.dmp

Download

memory/5856-97-0x0000000000B60000-0x0000000000B68000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads