bac6f6a848004282c85b83879b268690ee0693e4ab10565ecf592cc602fa0e4f

General

Target
2026-07-20_72c2d9d1ae4d9f61d8ce166f868a18ab_elex_wannacry.exe
Size 1.2MB
Sample260720-dg8m7sdt2n
SHA256 bac6f6a848004282c85b83879b268690ee0693e4ab10565ecf592cc602fa0e4f
MD5 72c2d9d1ae4d9f61d8ce166f868a18ab
SHA1 e1bb66d33fe328cb4f3f8df4e93aa468ce56fb92
SHA512 f63bf662ae16f4da7374317784bba99d2b1c73a61635a3587bce52eea4a5ef31f71ca6c71cc0d37a0980dca4fcc3ffe17b83a6384d9d1da73fd188d5980b472a
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeU4UUU3UUUhYA+wdgY:s6F0eMpAAYEhphU4UUU3UUUihwyY
TLSH
T1A0456D54E783C4F5ED2314F1444BEBFBA5309E1980318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2792	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_72c2d9d1ae4d9f61d8ce166f868a18ab_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	original_temp.exe
2792	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2792	1756	2026-07-20_72c2d9d1ae4d9f61d8ce166f868a18ab_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_72c2d9d1ae4d9f61d8ce166f868a18ab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_72c2d9d1ae4d9f61d8ce166f868a18ab_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 e8a9f62e0422ceb57c8977c482cff5a30162f854757518e3908dadb9d08cef47
MD5 fa65ce8be04b4aeb1d5fbedb4a89359b
SHA1 e413bc5bff6c8dd6ef3629ddf09f71e104a54e93
SHA512 4235717e1046076b4d2026609bf1e10e79103c6742c4d627f14bc9a254144c79342ecd260b2c57a19639832a07bae11c43e5a13d3da16f7cdad4509657392ea5
SSDEEP 49152:X6F0eMpAAYEhpPU4UUU3UUUihwg8XpiMD:+0nAAYEpPU4UUU3UUUih5gpiM
TLSH
T1A3757C50E7C780B1F97316F0496BE7BA5530BD258831C92FE7C8EE09B9B2951A538723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ac89cc75899024714200644afae658c1012c4473ca2261c12419986103b848f1
MD5 761a73b5ba649d02172277bd28cffc0e
SHA1 e6e19daba53376a9c78dbca7457092a0bf3075d3
SHA512 7639690283ba76aaf19d115faf051a4132e4062506f288918539d4749951c879417267bf9accfa7aab7de353dcd97e221b533b0280b1eb5ba00902fdfe8007e8
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeU4UUU3UUUhYA+wdg:s6F0eMpAAYEhphU4UUU3UUUihwy
TLSH
T125456D64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7fb8d6d633e007a9c39ac05f11c3446d25fbb4a0c7990703e8fc72c3d268213c
MD5 7ed5de33954d5e5711d3986d1c5a429d
SHA1 c013c6da2dc05fef070015c6c250ef20f3038fb9
SHA512 05d939636ea401179e0e994c19286363af149cd875f1519b525e121645735782716908eb26ba3f8fc1655039c76cda8aa230f4643207af91d9a91d726215df89
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOBU4UUU3UUUhYA+w8S:D6F0eMpAAYEhpuU4UUU3UUUihwT
TLSH
T125456D64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 e8ffe59d79c1502ae03e02d4f3d88decdc695b34757bd6703f18080d35eae38a
MD5 8c850b76685754e0040516a7f5f224d6
SHA1 d22a6ac318666198ab630a98a2b6f08e64f29d1a
SHA512 92fb79ae9183dbf65d6477754a8314384119d833b2962cb5ad111b70396cbb10231b1ab37f9d1671db1a4e3e78819ba1005b412ccd7aba52e63f327bd238beee
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOvU4UUU3UUUhYA+wfk:z6F0eMpAAYEhpoU4UUU3UUUihwc
TLSH
T1FF456D54E783C4F5ED2314F1444BEBFBA5309E1980318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 66de30b0477fc4b3b6f1df423196249300bdcf93fa49e5b42833f0e8da1bd5b2
MD5 cc376cb432fc9d6b70cf3fc34f0e8c4c
SHA1 a92e955b47dbc03f0d361320ab26969203e509a9
SHA512 1f5b1b44051df0b1bf4c5f475e43aa3f15136582ac6a0caf9b3170263a015a272031b5e148f8564812d9be997340551ae13be404b42d21ebfb75dcf16b5c62cd
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOCU4UUU3UUUhYA+w8U:r6F0eMpAAYEhplU4UUU3UUUihwl
TLSH
T17D456D54E783C4F5ED2314F1444BEBFBA5309E1980318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 6cbbd1455e5b9f53c064cfd5d3ab346863c012c29d2b8bf0bdab82279d3dffcd
MD5 ed05e659fd9d85756b07f0ffe5eb5d82
SHA1 861c1c614b66cfbdaefae9dfff3bf8e103ea8a8f
SHA512 557fd0e80cc5762884239c04734ca552c54871bc0e309ba704298162f2713bbaa97ad77e46718830ece5e5872f36afc0dc15983433b496f6ba5d12adac77b010
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6U4UUU3UUUhYA+w88:E6F0eMpAAYEhppU4UUU3UUUihwN
TLSH
T101456D64E783C4F5ED2314F1444BEBFBA5309E1940318D6BFBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-155-0x0000000000400000-0x0000000000535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads