ff06e38d5a9e5b01c42497ed9e7ba385ba1a239184edb12cec8f195c11220be2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_2f03523689bb445a0d40b2df29573b96_coinminer_elex_mimic_pay2key_wannacry.exe
Size 6.6MB
Sample260702-2w85aacz2m
SHA256 ff06e38d5a9e5b01c42497ed9e7ba385ba1a239184edb12cec8f195c11220be2
MD5 2f03523689bb445a0d40b2df29573b96
SHA1 21b5308277c281ecb25699ff221ea955ea254c14
SHA512 2db996eb01cffd039a5fe1d80e8151dcea6d8fa1419bd3b72d84191305535e13681d87f8bf60ea3f04c1d963292d5a8a4874a4b93d33778826cd1f0603def137
SSDEEP 196608:Rgm2Vre/HWcnhd9mi1PrLXQVdq1qj+ZtwZdO/3f+Hw:RgTY/HVDRPHgsqqZtqM/3fr
TLSH
T109663343EBC3863DC35126365247968100BF23A71B79A8DF57A91A1B3E2038E537B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Executes dropped EXE 1 IoCs

pid	Process
1464	DXSETUP.exe

Loads dropped DLL 3 IoCs

pid	Process
1464	DXSETUP.exe
1464	DXSETUP.exe
1464	DXSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_2f03523689bb445a0d40b2df29573b96_coinminer_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 1464	5900	2026-07-02_2f03523689bb445a0d40b2df29573b96_coinminer_elex_mimic_pay2key_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f03523689bb445a0d40b2df29573b96_coinminer_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f03523689bb445a0d40b2df29573b96_coinminer_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dsetup.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads