8ea2815a17d14ae754a98d487fd01b70bf6f3e537b205e3ebc2a640ec68dee84

General

Target
2026-07-17_8920ef3ac55f53ac51ee95b84c5d2c2c_elex_wannacry.exe
Size 1.2MB
Sample260717-jmpeeaew9j
SHA256 8ea2815a17d14ae754a98d487fd01b70bf6f3e537b205e3ebc2a640ec68dee84
MD5 8920ef3ac55f53ac51ee95b84c5d2c2c
SHA1 499dff98ba8a86840fe2b29a4a2021329433a7b2
SHA512 e803fa9a05222a533e13d9fd4fc77f0d4d9aacf86215d3d999c2a917d0fa66e43a91cfcb9b305365883a72dfdea0795eb408813592aa32024cdf125b91bd1598
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOqoA+wYNU:+6F0eMpAAYEhpLohwMU
TLSH
T115456C94E78384F5FD2315F1444FFBFBA5309A1A40318D6BFB88DE10BAB2D623529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4528	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_8920ef3ac55f53ac51ee95b84c5d2c2c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4528	original_temp.exe
4528	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4528	1944	2026-07-17_8920ef3ac55f53ac51ee95b84c5d2c2c_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8920ef3ac55f53ac51ee95b84c5d2c2c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8920ef3ac55f53ac51ee95b84c5d2c2c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX48EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX48EA.tmp
Size 1.1MB
SHA256 3429a88597d7e8364f73c6feed64e5d7183bb32bd5811f153e581e20c4e56983
MD5 0a2b7dbf83e43545185a8f66aec95bca
SHA1 727929fb24c9a67eab671f73072a6ff01fb204cd
SHA512 2d565602747843089c3032b4955597518eeadca44165bac065ee19acedbbcf51e2834c24af72b611d08e90bb5529b4560d7327cae9cffa12f9337ffe157a906f
SSDEEP 24576:R7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBoA+w9l:C6F0eMpAAYEhp0ohwv
TLSH
T16E456CA4E78384F5FD2314F1444FFBFBA5309A1940318D6BFB88DE10BAB2D627529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 87d0c46e35847a70cf5737038759b1262089cf7aff26365cdc33786d7bfaff32
MD5 2b384a8f793c8202ee9dd7c0ff587543
SHA1 9e8f04749539b2dfca1eebd45e6c26066712f7c7
SHA512 d5b2d7fdbae3fb3ce50de1207d7e09395a15c709b75ab4b5006742d44f496291aefc639c40b89a195727c8bee1081cd20e81aa0cb53be9deba923a3ed83d6853
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOqoA+wYN:+6F0eMpAAYEhpLohwM
TLSH
T1F6456C94E78384F5FD2315F1444FFBFBA5309A1A40318D6BFB88DE10BAB2D623529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a7ef76e57c24bf92088b72bc3f4c84355a97668ffa9023f7991d4cc2bd7f829c
MD5 306129148b390c0c86287b4ef3d91807
SHA1 34d0b8f2756138a9f6eee7b73d02acbfcd5a4020
SHA512 c891b7ae53b4e1e4d87d4349ff1d80fbc39decd42f516f0c5dac6464df0f5730967852b7673146125752a9ecf5ad99b282edc63f43df9784557269a69ee5fa9d
SSDEEP 24576:R7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnoA+wEb:C6F0eMpAAYEhpiohwe
TLSH
T15A456CA4E78384F5FD2315F1444FFBFBA5309A1940318D6BFB88DE10BAB2D623529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a6c44e60411e379a0fd129d12637a7376c2033561e7bb59b1da8c2db47543160
MD5 8f0b87aed9c7fadd3685a3436e725922
SHA1 d7c36142a8d9731c5dfbc8d27f8184a4f75e78a9
SHA512 14abdbd762e57910de1c9dd2e27ca0184db26798829226244aeaed7be146574659b38579244570cd9a1ea742608fa42a60cc76e735d31b2e05cb3613e283416d
SSDEEP 24576:B7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4oA+wKZ:S6F0eMpAAYEhptohwu
TLSH
T1F6456C94E78384F5FD2315F1444FFBFBA5309A1940318D6BFB88DE10BAB2D623529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-152-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads