97d6f00d235b82c83ae4e9be6d6ca7d5f474266eaca38b296445dd7cb9dd1c65

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_1890ccabf83601c5cca841e90ddf1584_elex_mimic_pay2key_wannacry.exe
Size 15.5MB
Sample260714-b6b97aew3x
SHA256 97d6f00d235b82c83ae4e9be6d6ca7d5f474266eaca38b296445dd7cb9dd1c65
MD5 1890ccabf83601c5cca841e90ddf1584
SHA1 394445f3786a858761bfcb6b081f94d4b2e6a112
SHA512 81b0e7202e834f1bb74e8d2af64d08ed376aa8f0197827b702d0d912962c668fe4976074ebfa4d2af509954155e586176acb0e6ffd0785c6cc5bf1bfd90d880a
SSDEEP 393216:8g47JpNg7MoZjhlgve65QCJEnPIR38AvC8Cw4qtUYvRpjyE8VShwDtiPeHoGV6w:SQZwvX54PE8iC0DzjyLVShnPaoGQw
TLSH
T195F6339570FADDA9CC8369388089B363D8F2FB8FAF1486D771409E604D181DF9B35A85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Executes dropped EXE 1 IoCs

pid	Process
4772	DXSETUP.exe

Loads dropped DLL 3 IoCs

pid	Process
4772	DXSETUP.exe
4772	DXSETUP.exe
4772	DXSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_1890ccabf83601c5cca841e90ddf1584_elex_mimic_pay2key_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5704 wrote to memory of 4772	5704	2026-07-13_1890ccabf83601c5cca841e90ddf1584_elex_mimic_pay2key_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-13_1890ccabf83601c5cca841e90ddf1584_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_1890ccabf83601c5cca841e90ddf1584_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DSETUP32.DLL
Size 1.6MB
SHA256 9db4910b99cfed2a5944303ac6ff0f609c335131c4ee3e75a1b4c61d3c1a6ce3
MD5 1d6b292da474d3f0f780664d6883257c
SHA1 5d85598505ab32331d2c880b03bf66af50f1eece
SHA512 b6d772e4606f9fd313134bd0d4120cb17f2c0ab27e36c255e9b5889b21faca987b9f255ba12d8f1eb7112b55aa2dafbceff19d4e12d45b5e03185f831b6f8fb7
SSDEEP 49152:9jxO/ZOOOOOOOOOOOOOOOOMiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXT:TCO
TLSH
T1A175AE35B1D40331E6B203B167128AB7F73EDBDDE21AD521B9AE82552186B8CC33E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
Size 516KB
SHA256 d6bcd10c6f9d9137189de9a9b9f76f033b8e5022129b710a9a3091116cd45ec5
MD5 2cfd505070ee1ae30c70f1cc8b4a3b23
SHA1 4762ff4ef24eba02c751c4a9d2027e0a754d9661
SHA512 6a3c119805d580e3d729f789b5cdce1febe061d0f437426b1189b0f4ba5aa5eacaffb3d1d114ec9275c9b6afd1903bf2b91afec6e03ba9f49a1dbf5fd24823f4
SSDEEP 3072:3i6LKeIXbJ8nUc2nDzw0FWtj/WM0PSQ5lbSN2LhaM96rKmMH2/5Mjt4zT1mFDYkV:xZ2nDzw0FWdwewUM1Ws4VfgJ
TLSH
T1DAB41C1067F99225F4F36B386A7913964E3ABE91DD38C55E6314319E4A31E80DE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dsetup.dll
Size 95KB
SHA256 5b4c9977c41f7c53c2574385e41c4c70bc407e48a9c9ac79c3a0964debb10f04
MD5 3a221f6a9e1a57dbb4724da320381d00
SHA1 86b9efe9e8c366512dfb787d254433fd62ea1671
SHA512 17ae3d57b9ac98d803d7a5534c4f62962c7f1969aa1cfa501bb6763fa94a2e1b212e139a368569d4141a7e2693e007407ab955e0765c58eaaa20cfa4a1aac678
SSDEEP 1536:SLtBqvGTWmOeR3+MPb3hzgS/1nJvMgqAlTJQs0MajclgUukW+j2c5o5INSkVg7XL:UtAvGymOA39b3h7/1CfWYcZ5x5o58Skg
TLSH
T172937D15BE50C072DCD120B916CCE7B1A6BEE1B00B2999C7B35447DAD9613C6AA3934F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads