cf3cda6d7dc72df92a0f495c16fe8bddc9743bb5badfc6bb1d6632e26cdb0540

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3a528160b5b51431134d631f764013d6_elex_wannacry.exe
Size 1.2MB
Sample260804-jh57csal2v
SHA256 cf3cda6d7dc72df92a0f495c16fe8bddc9743bb5badfc6bb1d6632e26cdb0540
MD5 3a528160b5b51431134d631f764013d6
SHA1 4b90416f6eb9f73c6f4ad3245f4fed8ff8891a13
SHA512 7b871f7b3a63522da881fd544e5d32b4b0a9e338ee7bb4b00982bfe653ce204a922535c4f9c46a8ebb1de93b2f9ed1f7d1cab24f3f3b857c2f6d37da9775ea79
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtYA+wN8m:86F0eMpAAYEhpdhwem
TLSH
T1CF455C54E643C6F7ED2314F0844BE7FB55309E1980318D2BFBC8FE11BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5536	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_3a528160b5b51431134d631f764013d6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5536	original_temp.exe
5536	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 5536	2624	2026-08-04_3a528160b5b51431134d631f764013d6_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3a528160b5b51431134d631f764013d6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3a528160b5b51431134d631f764013d6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 dcb442e100c2cd01bb65dd2fde64739773261dc2e8e93c1271615ca27088fe4c
MD5 abb0b262402aa44fc906602212fa4afa
SHA1 63699e4f5bbee0491a9be67bb9c659fd3fb43c9a
SHA512 960e98ff5231f0b16720883bd7cffcc3474a2cabdbccfdd144899b913a83b592eb5ea1cec8ecfa0ec0660deeff5dfc2b10faa6fa9cf1a6f07214c403e4407733
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtYA+wN8:86F0eMpAAYEhpdhwe
TLSH
T113455C54E643C6F7ED2310F0844BE7FB65309E1980318D67FBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 d8e5a731c75c85c7944ae88c21066a6d589149d45092ff4216756caf60bd7100
MD5 2f47999d1498bb0a3b82f35db468be19
SHA1 ac4a628997c35dc19af09ebf14d3fd9661dee572
SHA512 63750417206c5167e17e7f802f80352b3d5413134d46d58297f273e41225a77b4f324cdae3a277b31310d9caf37fe7c569c8851f14f5494665f681f3abed3ff4
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtYA+wMu:Y6F0eMpAAYEhpJhwn
TLSH
T1B3455C54E643C6F7ED2310F0844BE7FB65309E1980318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 b2711da826bf84d67a6f6c6f6a271cfc474ef32ca7aa00605c8bd1f93d396c10
MD5 9c3f719b47e481fb3b890c6c3d72a3f4
SHA1 5ea0d5403810a930b0be93ebc8fcc8496f1c7a44
SHA512 9b9c6e6d1d68497bc48f3903b77d7970c5ac80846bc028d4e01f7273b15c7e877c054095b45df9cfc7b47d8aafed855069fabbe6c7dc508a8d92c7f8e6cfe93d
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfYA+wPQ:Y6F0eMpAAYEhpLhw4
TLSH
T14B455C54E643C6F7ED2310F0844BE7FB65309E1980318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 a813349479f4e58a8fccffcefd5b369abeb92b014c5ec8f55fbaf2af3e68bcdb
MD5 6e8eec178e7b6a7456198ffb3d5a3896
SHA1 eea72b1b5ae55395bf3cb67a1b710a8d93eee37d
SHA512 b04c9fe24448044a5e439fe78e24e94ad1009ff38f596cd121ed65bf4f0f47c5b763ed59dce0530b64266e714a09458afed4dbc65615e5d147137d743f308e2a
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODYA+w8E:86F0eMpAAYEhpzhwZ
TLSH
T171455C54E643C6F7E92310F0844BE7FB65309E19C0318D6BFBC8FE11BAB2D5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-154-0x0000000000400000-0x0000000000531000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads