2ae0f7387cc923f6e1488d7e955039fb4c3fdcb27c6024863ae901c6521cf706

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_4bcfd14c9e3c79b561ee07f3ae341382_elex_wannacry.exe
Size 1.9MB
Sample260708-fbbsdsaz9s
SHA256 2ae0f7387cc923f6e1488d7e955039fb4c3fdcb27c6024863ae901c6521cf706
MD5 4bcfd14c9e3c79b561ee07f3ae341382
SHA1 4171587cd79277d2382221c863c35c019d09d0fb
SHA512 163c2212075b84edc4343b11c04a1c4d40efc2f540fdbeeecbdd86604692f2fa660d4de2f625319c43ced2bfaabb0154eaa651ab48b6ee2b966732e22acbc756
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORqj7s:q6F0eMpAAYEhpsqPs
TLSH
T1CB9549D5FE82F2F2E8920CF1350BF6FED5236D2588228953B687FF28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3000	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_4bcfd14c9e3c79b561ee07f3ae341382_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3000	original_temp.exe
3000	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3000	1944	2026-07-08_4bcfd14c9e3c79b561ee07f3ae341382_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-08_4bcfd14c9e3c79b561ee07f3ae341382_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_4bcfd14c9e3c79b561ee07f3ae341382_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX2796.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2796.tmp
Size 1.9MB
SHA256 02e49baf401c719d6116583d04f83c3480799d69b062256f919a3b55bf9ce4b7
MD5 44cecbdf56d46499cc5e7120d7b6e715
SHA1 c52e3c18339d913e494da1ef5d00628e85566c1f
SHA512 1e8c5eaa12deb2af4613641662fb5de3e2f7bd79698b665dadba4f83226bc7f50d523714acd66262aae1adfd97a5aba4faf04cae672ecf7ecd8de8da1b2c5398
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO2qCP:u6F0eMpAAYEhpHqY
TLSH
T1919539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 e881b8344e9c5eb437de5190a46b72ed086841a0906d78a49e41da7ad448ac3d
MD5 8647002ddbbf57c779272b5427bd1a04
SHA1 3e0147cd1f3bef323137602f42a21eaf880a16f0
SHA512 1edb6cffadb530eb4c7acf827589efa1ba5e9bb2a4cbaa81432f6e6f5f5344140b1466d392db57057cc6630f696b9f1d59b02ffb3d55cc66244e3a06c1ba51f7
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORqj7:q6F0eMpAAYEhpsqP
TLSH
T1329539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 094d1f00967dae637c0edc1afe8d37cc534bf41200e96d3185ce2aa896f7477d
MD5 ac0b93ba73d167525833efb2ef9ba279
SHA1 b0c43160936bf3a916e9893dfcf5ced832e5122a
SHA512 cdf74af4b9caceb33262c4a4b4d59502cf618b5db025ed9b4ee9bb4e5c3e244073b6cbff9aaef28126552647179f4c7f2669229e56b2065273a2363acc17e841
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcq+V:q6F0eMpAAYEhplqq
TLSH
T1599539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 af0f52840125b3d08aa67e46e9f4660f2e72ea94b7ee7c3eb644ffd1b39b5671
MD5 0f857b0a2e8e15d2d32dd981e1f76489
SHA1 b787f1156d2dbb2ce28e00b287a15c027666521e
SHA512 961d45ecf6dcbbce32a0c0de9ee4d26f982542d897321b7aaa3cfa260cf9cb3f398cba98ce9896f3866d1b76537d2fd56384cdf41b789b6bdd0d9884c886270d
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsqC3:K6F0eMpAAYEhpNqg
TLSH
T1899539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-155-0x0000000000400000-0x00000000005F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads