Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 03:11
General
- Target 2026-07-19_8031ecd2b95ba4d16659aab150065f4d_elex_wannacry.exe
- Size 52.7MB
- Sample260719-dpqglaav8j
- SHA256 70d8362631863cfec2a146cbe6bf90e84bd1fa552674f683b1026fd4464c2466
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies registry class 36 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_8031ecd2b95ba4d16659aab150065f4d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8031ecd2b95ba4d16659aab150065f4d_elex_wannacry.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript.exe /nologo "C:\Users\Admin\AppData\Roaming\Telegram\adddf.vbe" C:\2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\gentee25\tsetup-x64.7.0.1.exe"C:\Users\Admin\AppData\Local\Temp\gentee25\tsetup-x64.7.0.1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OV2BH.tmp\tsetup-x64.7.0.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-OV2BH.tmp\tsetup-x64.7.0.1.tmp" /SL5="$50116,53044557,826880,C:\Users\Admin\AppData\Local\Temp\gentee25\tsetup-x64.7.0.1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gentee25\zgqmQcC2.exe"C:\Users\Admin\AppData\Local\Temp\gentee25\zgqmQcC2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FA64C.tmp\zgqmQcC2.tmp"C:\Users\Admin\AppData\Local\Temp\is-FA64C.tmp\zgqmQcC2.tmp" /SL5="$60116,1022550,821760,C:\Users\Admin\AppData\Local\Temp\gentee25\zgqmQcC2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\38ca41c0.dll,aFoea5TzG1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\38ca41c0.dll,aFoea5TzG2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe"C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /tn MicrosoftToolKit2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe1⤵
-
C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exeC:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
38ca41c0.dll
MicrosoftPhotos.exe
guig.dll
zgqmQcC2.exe
genteert.dll
zgqmQcC2.tmp
tsetup-x64.7.0.1.tmp
4edd76bb.dll
d3dcompiler_47.dll
adddf.vbe
memory/2976-21-0x0000000000AD0000-0x0000000000BA8000-memory.dmp
memory/2976-64-0x0000000000AD0000-0x0000000000BA8000-memory.dmp
memory/2976-30-0x0000000000AD0000-0x0000000000BA8000-memory.dmp
memory/3404-67-0x00000000001C0000-0x0000000000298000-memory.dmp
memory/3404-137-0x00000000001C0000-0x0000000000298000-memory.dmp
memory/4428-135-0x0000000000860000-0x0000000000BC4000-memory.dmp
memory/5724-32-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/5724-34-0x00000000005B0000-0x000000000090F000-memory.dmp
memory/5724-28-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/5724-62-0x00000000005B0000-0x000000000090F000-memory.dmp
memory/5724-31-0x00000000005B0000-0x000000000090F000-memory.dmp
memory/5724-52-0x00000000005B0000-0x000000000090F000-memory.dmp
memory/5724-36-0x00000000005B0000-0x000000000090F000-memory.dmp
memory/5768-143-0x0000000002CC0000-0x0000000002CE8000-memory.dmp