f4d0b2873b804339dfe3296743b16eae2489e24ceaad0d9fca3f4b9beabf614f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe
Size 1.2MB
Sample260720-dndfmsdv8r
SHA256 f4d0b2873b804339dfe3296743b16eae2489e24ceaad0d9fca3f4b9beabf614f
MD5 551804746c6513e75a0b07158e6d6333
SHA1 1fc43f31085fdf73ed04c0ee7491bf85bfb08d64
SHA512 7150035cb3d5b8a4604a2a82e192a52eb31473d17435aef2e432247814113642db6e06d110001a085bb192b47d56dea7215507dc71a52a11dbc2284ab1b5805d
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTYA+wNMY:m6F0eMpAAYEhpfhwuY
TLSH
T157455C54E643CEF5E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1872	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1872	original_temp.exe
1872	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1872	3604	2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX47B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX47B2.tmp
Size 1.1MB
SHA256 ae337543ac114cc146ce9a16ffae1bd12bd2cf9d2fa61e4e07f25181974dad82
MD5 f52e0bcfed4358199307ae601f7ff6a1
SHA1 98af475b90400dec4fceabcb38e30f2e30590718
SHA512 f1ab2058d1cfb36dc74e501ff530221428addef813fca3367655913bcab90a56f26518cb84b8fc0cbe4241bbb74dd6527f5296106d4c6bb63b795c90a16ada2e
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTYA+wNM:m6F0eMpAAYEhpfhwu
TLSH
T19C455C54E643CEF1E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 924c9e2eb9c769d44b75db5512bfdb0fec54e9df40e68beebc99902083594567
MD5 2457ed172340fc2beaf5422487112b7d
SHA1 32a0b74ad9bbea6a79cb0920af451055b93932a3
SHA512 5c79446958c8c6afc6d8c26ae88c0b3483657b9c2c53c7b2909dc7c888e424a64634489b526e97b446f2b736d371edc260775877236277faa511b0b35af60c27
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlYA+wNU:m6F0eMpAAYEhpVhwW
TLSH
T16B455C54E643CEF1E92B00F0444BE7FB55329E198C318FA7EAC8FE11BA72D522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 82347b3711cc6a016204bf8ede9efe06e170a44ec72dfbed858807f2fbb6fc40
MD5 5fcca6488701a692b33f15777093e1f0
SHA1 0186943874d6ba5bb9a7c11c5b90176b607ce7ba
SHA512 ead0d316ea294e4d38208b7972c88eef5fb8237317aa482e158dcbe0aa2e6251c95ef9526bf06c77962ed49b15ffa0b6b8195c8acf6bddcfe5afbe9f4da94358
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+wPg:G6F0eMpAAYEhpWhwI
TLSH
T11D456C54E643CEF5E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3604-260-0x0000000000400000-0x000000000052D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads