923808c6a5cf605614caa592f4d5d25d75b416a54c144532b0401dc861c5b8be

General

Target
2026-08-04_480080298466519312cee8419bf61eb6_elex_wannacry.exe
Size 1.2MB
Sample260804-h96rjayzbv
SHA256 923808c6a5cf605614caa592f4d5d25d75b416a54c144532b0401dc861c5b8be
MD5 480080298466519312cee8419bf61eb6
SHA1 6c82a15df04f96a7a9b21aafdf058db67777168c
SHA512 ff8ad0d98016f2f3b9f82b65ee7560c615314ec1bbfa2521e4a208bcb3f049b54ca2cc2078e610afa4c95a3da4ff70f56b65ffd89c2fe2303d3d03a520ea8ad8
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuIYA+wLX4:o6F0eMpAAYEhpXhwr4
TLSH
T166456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4980	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_480080298466519312cee8419bf61eb6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	original_temp.exe
4980	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4980	1060	2026-08-04_480080298466519312cee8419bf61eb6_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_480080298466519312cee8419bf61eb6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_480080298466519312cee8419bf61eb6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windowsdesktop-runtime-6.0.27-win-x64.exe

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
Size 1.8MB
SHA256 3701ff00a6788b102e5f40dbdd515e6328bf2c2d5543476e5b0a2594547026cd
MD5 153cbc83dcb68392ead25133f8c31e3c
SHA1 09153e8d2d2b6a91efa884248c344b0d4d01327a
SHA512 571dcae95b923e25648e400a5ab95edbaea8d56ac5b5278bfd72e3039175a334ae4277d10b94e49e61d7cd8c4bdb126d1f9dda46994bac9fa246eed073090df8
SSDEEP 24576:87VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObIYA+wuiP5mWpI2jFM5sFU:f6F0eMpAAYEhpChwRP5BjBbTpi75Zr6E
TLSH
T177859E60E64384F2F97300F1540BE7B669349F294021CD7BFBC8EE15BEB2952267B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 af63fb942bc1c89c728d944ab5cb4878d8810837f1abd96893d4a8e9591bf3b4
MD5 96734516ce8c2fb8262419ec2c0627b5
SHA1 8e2c19d9a6984d126e25e6c54495e6a254634f28
SHA512 0843d5345ef226be8b3917327b15f538184f2feb45aa6b17e7b0a844dfc7b8c249fd7612a24168a5c5e8f0ed1a5d4602e7773c4030db0ff357be43c6d7cd2843
SSDEEP 393216:trlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vX3:thWO1c877xqpyovvVWJ6VFK+q3cSvX3
TLSH
T1CE5712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2EEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2EEB.tmp
Size 1.2MB
SHA256 71e047b66613f69b60c36f76ea7b88165950589d56d274758bd4597cb25819a3
MD5 d3e4c7f093fca89113741b48b41b6f10
SHA1 45b74fd6e89228623c20e30be1c824eb73ea8078
SHA512 48fc6ac2ac1f30d8f93e293975dad791e7a99016d943e25ca2d9536d08e030a3e18fa2533a977a8eccda80414d2649c5f51d9b902d10eec00dc05b5832473de2
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOuIYA+wLX:o6F0eMpAAYEhpXhwr
TLSH
T1D0456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3585.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3585.tmp
Size 1.2MB
SHA256 1c7bdb318989ce1af7086c1c49d7d991a98e4bf71efff462cb9547eb02e42608
MD5 2db1bf392cd79696004cdca210dcc1d8
SHA1 0fd059645f81e0b69cb5ee695d4f9b8aa14c58d9
SHA512 a8c32c9cf04e3302d4ceb51f07da2de9ff97157f9b3a1b05b5985ccf7c2a5d1895bac1762252cad373d91fa460989efaeea541ec4338708efc84ab2836614a1b
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONIYA+wua:I6F0eMpAAYEhpYhwJ
TLSH
T182456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3586.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3586.tmp
Size 1.2MB
SHA256 e8bb804d62a75bd2b6e6d464dd5292870414a2a7f4abed88ab20d13b4709bdaa
MD5 a2cd210d8c771fb27e7f8e3014025863
SHA1 ca3e6c8116b8f0dbff47aee3c38c2b82f37850ee
SHA512 652436c5b555c4a6294aefb411113914432a5e0a7fd9f5b0456aeac5d238ce84db5453b7f87c3380dc4f19731e54e256033ca3e5fdf88d974decf07a6550e821
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/IYA+wLv:36F0eMpAAYEhpqhwD
TLSH
T19A456C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-274-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads