a1959390a696a11d49e0317fed3c74dd9cd169578e0f03e7335d68fe76289abc

Analysis

max time kernel
147s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_637af67faa7aba4fe37acbb63d819810_coinminer_elex_wannacry.exe
Size 2.0MB
Sample260728-g53cwaff39
SHA256 a1959390a696a11d49e0317fed3c74dd9cd169578e0f03e7335d68fe76289abc
MD5 637af67faa7aba4fe37acbb63d819810
SHA1 8637ab715de648a65b04763ae5a640ef16bc5863
SHA512 dda3a3bceecd18aaa2b647c494dab1405775062a0c7a69c4955d6b0015bf400761e66b24a2befedebaa8b5d1ad21b110a21ce2ed0a1fea415c9f34bf35b01872
SSDEEP 49152:utsUtSkz+iUuJdByxOH6bzkBp+Bm7E4o/J44Xjg+/:ut3qiUCg86bYbfQP4A1
TLSH
T159A5124EF6928177D692053E349EDA2126339F9D0A3EC343DA74B40B35312DEDA29E47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2016	vcOnlineInstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_637af67faa7aba4fe37acbb63d819810_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcOnlineInstall.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2016	1308	2026-07-28_637af67faa7aba4fe37acbb63d819810_coinminer_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_637af67faa7aba4fe37acbb63d819810_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_637af67faa7aba4fe37acbb63d819810_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\vcOnlineInstall.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\vcOnlineInstall.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Check_Selected.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Check_Selected.png
Size 1KB
SHA256 0946efee104652f084c6fb2f271b06fcdfb50de893d64cd4287cc8e64deced92
MD5 6d116dccaac5056d7d1f4a593d5ac0db
SHA1 242a6a198c7e1e22bda176065cf0b26a276b6f72
SHA512 037c4cb011492a27da3f7a6d2e7e75cabac8c58eca3607d57df248491b4786247c08a2f9ffd5fe49d3ef0b9f862b3ecb4a4783e04b1801c13935f271df224e79
TLSH
T177216745EA50BC81321EDAC115E9D06BE9725780E5D0E5216CCEC4120C305F99AAA4CB
MD5 SHA1 SHA512 TLSH

Submit Download

Close_Nomal.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Close_Nomal.png
Size 1KB
SHA256 cbe96210dc6c28e21625c01db80e510152eecbf4ddbc75a30feeefb9ffa318ef
MD5 99fcff2aca703823e083cb90a3192146
SHA1 376158f2e3e6c4f42e67415f180539d562bd27fb
SHA512 86b51f428a34f7de88f8aa5268028c86dee41a894ec3704c7ba10c0c8f7ef065af9c18d8d1999c903c5aa062abb2910630477b3b11db02f33c6e77373cff3d2c
TLSH
T1A9215457EE402C81A88DDE4239F6C017B9A34C40CAD1E5317ACDC41B2EEC4FA88E95D6
MD5 SHA1 SHA512 TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Config.ini
Size 616B
SHA256 f9126b0e42bef40fc0364455f7dd5e689278cb90f4740d95bc5792d4b7d8f9c0
MD5 81f218358d102fef782273af322cf149
SHA1 e290db0ae11d47a40aaa64921aec7465da1d3851
SHA512 2221206c3b136afc99f55b00c3bced801d5677ef2aee842dcb03ed64d07c853e7fdf326ea1b31026ec38522159a7b54bdf4a1364c82ba626a3d671397b8f59f3
TLSH
T1CDF04C97AC4BC6215F13E8C0EA831158F7B918A7B88D27D09EC2A047409F941109D747
MD5 SHA1 SHA512 TLSH

Submit Download

Dropdown_Nomal.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Dropdown_Nomal.png
Size 1KB
SHA256 0f8ed5fdb53a8895e0159855268e0b8bb084766473ceb3ced8b96209844e359f
MD5 79a297af3cc5d3501558bfc2344f250a
SHA1 7cae747038212afaf6ac69ae57e99cdf9a7ee97d
SHA512 e5e4a5feb042725564885be76d8a6bf7d1e68fcd8734822c8f5b5653f1cef9065dfa7d07e57df24332a95567020bb9135ae2233b9d7fbe0a6caa4cd5691b0c0a
TLSH
T15011864DFD02AEC1619DDAC258F6851699B30840C5C1F4BA6DDDC433EC742B4685C5CF
MD5 SHA1 SHA512 TLSH

Submit Download

Installnow_nomal.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Installnow_nomal.png
Size 1KB
SHA256 7a668d959b0c980edb8fa1b1a359e881f7865a4ec78f879afb2460f99c45367c
MD5 5a02fb88141286b03e5c96bfab807c11
SHA1 4639a647d31d267cf08f4d3e92d62e61749ca1fa
SHA512 f6d8b34e7c60ec8ad8d43b6cdb449dd608d29efd2abe377b2439e8fbdb70b72b048948fb17a65dd8b4469c2c65bbfb2e7c583cb880441e26a0d41b14f1e27c7b
TLSH
T194217788EB1A1A404699F5552CF641275D2A4DC0DEA0E7B4B0DBC8711C300E5A6195CB
MD5 SHA1 SHA512 TLSH

Submit Download

Language.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Language.ini
Size 62B
SHA256 a909bbf81d2bf5ef3367fc27382da0dc103eaca4b81b632fb59ca37f91dffed4
MD5 62ccac5b33f679c7b8be45ca7bf47fd2
SHA1 c07bfd514f77cf51c3b510bf09520045d10cbc26
SHA512 f74980f26f8b91fca47243aca981f7502356bbb1a5624ff560bbae282f9959af8c4cb068c5f9d3085facc51113dea46480985160cbb18bcb9533bd6a08ed57d0
TLSH
T16BA002CFEBBF2679270C009554625C5A244C55CBC256099AB5AA1726C504904651C89D
MD5 SHA1 SHA512 TLSH

Submit Download

Main.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\Main.png
Size 14KB
SHA256 b4d1ecedd6f9c6885be062eb7c20ee77aaa65148de8b2fd4a9840a41ddd6b8a3
MD5 46d6e6330c57bfb7cc4c0730530f4a51
SHA1 f6a139f4594f1ff063b8dbfac1f11a3293d7b4e7
SHA512 e3368dea19f1c5a0f9200e7f7bf0a0ada0db7490ac3a36750b7e8545e0a278e6da2f53e9a554d6fb2a7bb95e552ddc3f8dc69bb77118c9b6456a8e12e02ccfe8
SSDEEP 192:Y7FyqXOO2gkgQGDxtGvpLpaH/7SPoY64oJLxhg/HkfhsMBT1d/OlZ9H/FiY:Y9INI0zaDwiLsMfYb9Hj
TLSH
T148527E3D86CC2648E8D88D57D5EB493F6C6E4CC2D3506622FB0DDB2C6A87764B60C90A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MainUI.xml

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\skin_anima\MainUI.xml
Size 9KB
SHA256 9ac0e528c2a92ab254776f6b6b35824bebd01f7401cf105d872fcaaf28369790
MD5 9709ae9be543e5a053a326ac6e0f66b8
SHA1 479da77dc0be76e8e57bc5ab2d8bb03fbff54fbf
SHA512 0a21b1efcb583257f6f4d3bb4bf67a5ce937c381fa5da1b95bb6b2f697fb7bfca6397b14fb4de905907f9405b6e187ee49bafdd77f9c7f3d4c56343b50ba2b6b
SSDEEP 192:2jiqkMPZ/T5XemItZhMzZ28HxLifHcow1W077UnvgTHaMe5c:TqkMh/T5XemItZhMt28HxLif8/1W0771
TLSH
T116120111B0B549F751FE21F8BA052B4C8A8EA39B431473ECBB4D1B1B4DB2C5701ABD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcOnlineInstall.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\vcOnlineInstall.exe
Size 4.3MB
SHA256 1d49b951e89c3d56d8cd8ed198e545a5e4537fa8f184d266cf1bfd75917c6df3
MD5 23075474e7e62dbff82f7f95177df36c
SHA1 e6f10231adf1e76da60f011ed1828e2e5bba0360
SHA512 7b8f7130fe47fc312112b6bef6e3e33c51a2782faf4073433117d21c691ca479e248eeac90d2f791126c016ec99aa1e826c6d35330cb5eb89f47bb13b5525fb6
SSDEEP 98304:M0ctDlILWrVA4WYQRWeQD6DwrYsAj8lPKgzVQ:jIUWrVA4WY2WesrMjMygzW
TLSH
T190266A0DB6424073E892017D76AE9B3A493BAE2C072CC3C39394395779315DEE63AE57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads