Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 10:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe
- Size 1.0MB
- Sample260703-l1rsssbz2m
- SHA256 0518eeaf20122126b52e51614903c32456de9cc6d44f255433a2a2b6cdafe535
- MD5 893c5a961d805676564fded1db42449d
- SHA1 72bc2b914fcc0bb7c24c5b9af16ceb86664f3e2e
- SHA512 2e607e60f1c3969bdd45e27f541ffbb388603a349d0f6d2d0c9a0fbc7e0509491aa914659b3e73b0a0abb9db5cc53b329084f29752ded895c881406ffefd2eb2
- SSDEEP 24576:c53uhFO7zPhXCDDf1kLMjgae35hzmoGMmGgzK2S:c5+hFOxafPg/35FmLzZS
- TLSH T13E3512123BD790F6F5B32B319C29B758B5BEBB640B1CC9EB1B5002462D72FE592B5081
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2752 taskslinger.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: taskslinger.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 3 api.ipify.org - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz taskslinger.exe - Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName taskslinger.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion taskslinger.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS taskslinger.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 2320 cmd.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe 2752 taskslinger.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2752 taskslinger.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3440 wrote to memory of 4812 3440 2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe 90 PID 3440 wrote to memory of 2320 3440 2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe 92 PID 2320 wrote to memory of 2752 2320 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\Taskslinger\KillDuplicate.cmd" "C:\Users\Admin\AppData\Local\Temp\Taskslinger" "2026-07-03_893c5a961d805676564fded1db42449d_coinminer_driverpack_elex_wannacry.exe""2⤵PID:4812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Taskslinger\TaskSlinger.bat" "2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Taskslinger\taskslinger.exetaskslinger.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Taskslinger\TaskSlinger.bat
- Size 91B
- SHA256 4959b103870507fe936595273fc8d0fedd72ae33fce7957728cc18191c49255a
- MD5 032aa3cc11006f9b0790a7cb3b32ca0d
- SHA1 8ad1e59664f05ce884a87263c7d4c9ae306aec73
- SHA512 e97be8b8a66bcb1314daa865a68d43f9d9678a57506643599607dad304a5f3916468884adc03bcf022fe38da3cca58d49eb95ff9a75135747226e2ce1ba2eb66
- TLSH T1D7B0228880E88C0AB08C00C382C00080283320CFC3BC3E0CC8F0E02C0880208C33CFC0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Taskslinger\taskslinger.exe
- Size 1.9MB
- SHA256 4b98b83a5a9b99b7088a3d786429660360115dfbac01d03a0a2e3ea4f22a589d
- MD5 42ca116615a7ec714f665096016956ce
- SHA1 1d24d7711c77feda33567f857343a104ccda8ce5
- SHA512 167cfa4a2ece8aa606b09a1ecfdc254a2b984adce47586a9b6c0b450ffa58e69047b6487a1bb9331080731e9c4a3c17e663c235bf38cfbd78edf34a59d1654a4
- SSDEEP 49152:daFW8cTXHHycuirxBFTjTUc+CgJMzM7PxJfPud1qE/Tc:5LiiNBFTvhlzM7ffQc
- TLSH T1EF95AE1563E902FCE07AF578E463A017EA3138095634D5EF16E148496FF33A19ABF326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\TaskSlinger\UserSettings.ini
- Size 2KB
- SHA256 6e4faa05c3f69611562291ad64c76a6626a8817dd9cf2789387c390ded63dd7e
- MD5 e7b2e3807d618c0d8d557532a7325279
- SHA1 6dd1d84150dc2d8d57f4ee295cba41f6a21290a2
- SHA512 eb5af2aaa8fd3e39852a9b7c379e86b6d24caeb914d822bf2fcbe9c829425c98490953063a90b9210ac545b7872645f915b64895e99596e5691fb88653bf656d
- TLSH T11A4176336A08032CD9E9A7B926B529190DE1BB42386F207C875304AEFFD1847597A77D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\TaskSlinger\themes.json
- Size 6KB
- SHA256 f685f9d0f9a57590a8e0997772ac4049c0200aadfa4850e7902ebd22a5a44ffc
- MD5 bee3b9696c2ba89f91894d82c692c26f
- SHA1 faa22aa3970a8b4e3ba0427ef14af322c011dd09
- SHA512 85f28a68b1406491a70dc076f5338ba335cb8be577a15e00c5a7f523d99a83ada5bd9bbbdea04a3e3247e810efae49b68ba091e3acfd02814f32d38842ae390c
- SSDEEP 96:pIe0hYZ83r/LX3z0B92sET2S0Onm4Fcdavw6fKGShdzahUHG:Ke0WZirL3oHqCS0IQdaojGShAhkG
- TLSH T1D2D11254DE6A7D4B651A519680E60E423891687F0C1CFEA9BB3E99EC4F5C14F8031B8F
- MD5 SHA1 SHA512 SSDEEP TLSH