7f8b6f179e3931dbfedb968b493d4cae4ff091a69b63b6c1a31d7dd50e7f0cf6

General

Target
2026-07-08_784d8a171747ae1dd6a68ae30f4e134d_elex_wannacry.exe
Size 1.9MB
Sample260708-e4zt9aay7x
SHA256 7f8b6f179e3931dbfedb968b493d4cae4ff091a69b63b6c1a31d7dd50e7f0cf6
MD5 784d8a171747ae1dd6a68ae30f4e134d
SHA1 aab12d9fc45dada4bae252dae62cdcd6f2bf9f54
SHA512 04229e8710d71e5f05a6fc8bcaa12df7650ae4e4dc8d8442d0d4b778df10dfe6956acb849025bf15a22524ca353774447a1572493f5f3f143867306f696765df
SSDEEP 24576:K7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObqidu:Z6F0eMpAAYEhpyqyu
TLSH
T14D953AD5FF82F1F2E8920CF1350BF6FED5236D2588228963B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3020	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_784d8a171747ae1dd6a68ae30f4e134d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3020	original_temp.exe
3020	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3020	4844	2026-07-08_784d8a171747ae1dd6a68ae30f4e134d_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-08_784d8a171747ae1dd6a68ae30f4e134d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_784d8a171747ae1dd6a68ae30f4e134d_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.5MB
SHA256 013e58844163ede6ffdf2faaad3ffaf257e4d711d07ffdb4fe06188fb52b79c4
MD5 6c508969160c3832b889e6b76be85874
SHA1 86f3401c02aba1cfa2b7d88adbb392b82369453f
SHA512 bbe1863bc455978b8312e41f207658a82f960a4a8df5af196fe7ddf690db5570439fa66b3da6f9ff8cacea8df7c00b91c8a872a2fd48eec41a77ce78ac151618
SSDEEP 393216:Cqvlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXh:CqtWO1c877xqpyovvVWJ6VFK+q3cSvXh
TLSH
T1676712D1BFD5B071F4A30A707A69A6BE85277C314B3281DB6283F71C16709D19A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX59D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX59D3.tmp
Size 1.9MB
SHA256 0fcb50c56bcf106a7f9876b1f313674eeb9462b436924cbe1e20f0c07dc1025f
MD5 126c3b80467db18026780f91c44d5c90
SHA1 42c0f92ad70148d7aca3f3f7475f4c2e07f19b09
SHA512 5a9fd937118117d6c147d3cf750094a16dc959c0ed8525ad9eb728915dd7022aefc8c76751724b49c0006f648cb111db49fe62ddea855945b8335ebd7845243e
SSDEEP 24576:K7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObqid:Z6F0eMpAAYEhpyqy
TLSH
T1B4953AD5FE82F1F2E8930CF1350BF6FED5236D2588228963B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5BE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5BE9.tmp
Size 1.9MB
SHA256 14c8b778cabde1679c0d49192260d42fb8c6b6ab08cfa075e3dc97bda1ae4fe0
MD5 c7660d004f063c52bbf1142bbe20d838
SHA1 a25d8e3938777d8d827b1d92fc6bded0fe07db26
SHA512 3bd045cc9a0b0ca6633df9d8c319427de84b96815958f9e417ac7399c74d8f18f13a47e7b805f233d2821f403494bb9980139e2e0371fe4fd6f30ce9b9c89135
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOWqfY:x6F0eMpAAYEhp7qw
TLSH
T1E7953AD5FE82F1F2E8930CF1350BF6FED5236D2588228963B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 f068012af1aef8c4d66b8c918fffd6418f2388fba8a8895bacbd454cfe5a423e
MD5 6884cb0f6f5a378d7bc2414aa967ab7a
SHA1 373252c0b84f1f34239d4878dda153f52551f114
SHA512 c97d8fb7824e27ed7aef8615655d3d6848061352f5b2dfb7768d20702d1a3cbd584bc6247585b99e7dfef4c242d709978295bc7d996b0f95e86b2beed48e95c2
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfqi1:u6F0eMpAAYEhpiqK
TLSH
T16F953AD5FE82F1F2E8920CF1350BF6FED5236D25C8228963B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4844-267-0x0000000000400000-0x00000000005EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads