f4d0b2873b804339dfe3296743b16eae2489e24ceaad0d9fca3f4b9beabf614f

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe
Size 1.2MB
Sample260720-dndfmsdv8r
SHA256 f4d0b2873b804339dfe3296743b16eae2489e24ceaad0d9fca3f4b9beabf614f
MD5 551804746c6513e75a0b07158e6d6333
SHA1 1fc43f31085fdf73ed04c0ee7491bf85bfb08d64
SHA512 7150035cb3d5b8a4604a2a82e192a52eb31473d17435aef2e432247814113642db6e06d110001a085bb192b47d56dea7215507dc71a52a11dbc2284ab1b5805d
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTYA+wNMY:m6F0eMpAAYEhpfhwuY
TLSH
T157455C54E643CEF5E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1332	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1332	original_temp.exe
1332	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1332	4864	2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_551804746c6513e75a0b07158e6d6333_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 ae337543ac114cc146ce9a16ffae1bd12bd2cf9d2fa61e4e07f25181974dad82
MD5 f52e0bcfed4358199307ae601f7ff6a1
SHA1 98af475b90400dec4fceabcb38e30f2e30590718
SHA512 f1ab2058d1cfb36dc74e501ff530221428addef813fca3367655913bcab90a56f26518cb84b8fc0cbe4241bbb74dd6527f5296106d4c6bb63b795c90a16ada2e
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTYA+wNM:m6F0eMpAAYEhpfhwu
TLSH
T19C455C54E643CEF1E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 82347b3711cc6a016204bf8ede9efe06e170a44ec72dfbed858807f2fbb6fc40
MD5 5fcca6488701a692b33f15777093e1f0
SHA1 0186943874d6ba5bb9a7c11c5b90176b607ce7ba
SHA512 ead0d316ea294e4d38208b7972c88eef5fb8237317aa482e158dcbe0aa2e6251c95ef9526bf06c77962ed49b15ffa0b6b8195c8acf6bddcfe5afbe9f4da94358
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+wPg:G6F0eMpAAYEhpWhwI
TLSH
T11D456C54E643CEF5E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 e40570d6e537cade153f929932a31ccd130c1a45074f004bb8d3ab3189f7d655
MD5 2df9f2afaefec870c239fd0e3e0221cc
SHA1 a8c226798ed2d0ca21bd9563df995ee546f713ec
SHA512 8bbf2ffb968408cff061b2f684ca106685c4c1c17ff09761aaac99d47990207d0c3366bfe5179eab49cc7d9e707e4ec9a06977bbd7463865faef5cbd2f24c7f2
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOwYA+wM+:m6F0eMpAAYEhpWhwX
TLSH
T14A455C54E643CEF1E92B00F0444BE7FB55329E194C318FA7EAC8FE11BAB2D522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 cc666d0232df8b60690becf701348c6a296a02b54873d57d9815fafe419cbb55
MD5 bbe40ceb53cb6d4d0849577e36eadfa3
SHA1 b2c2266bac7dbf791192f5fcbb2133b0545aa2de
SHA512 0c6b3c165b986d3083f8b78830f991d01523788f29da26b3cf822698670d19610e147a9814e7db8edb131f23113006e59bbd2cab24a25613f7dd17f9927ab911
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlYA+w8U:m6F0eMpAAYEhpVhwJ
TLSH
T186455C54E643CEF1E92B00F0444BE7FB55329E198C318FA7EAC8FE11BA72D522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4864-152-0x0000000000400000-0x000000000052D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads