47f3ca37e22b9804f0927299241df3312a0315cc88826a28053538a4685bab6d

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_62ebbcda273338d9c9ae08cb482bbc6d_elex_wannacry.exe
Size 1.2MB
Sample260804-nr29aavwgx
SHA256 47f3ca37e22b9804f0927299241df3312a0315cc88826a28053538a4685bab6d
MD5 62ebbcda273338d9c9ae08cb482bbc6d
SHA1 9bf33cb259bafee85eb356c94c7f344c582257d3
SHA512 8c1a200565fe4d5c9775509e07760265292cc1ff1b71951f86f12b4fd074b32df81af70750d518ddf09f38b09b1acb4c58304d66b8e7c6505e1edc5418a7f3ae
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPIYA+wy8+:Q6F0eMpAAYEhp2hwf+
TLSH
T12E456D54E743C9F5ED2700F0444BE7FB65319E2588318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5160	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_62ebbcda273338d9c9ae08cb482bbc6d_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5160	original_temp.exe
5160	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 5160	4880	2026-08-03_62ebbcda273338d9c9ae08cb482bbc6d_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_62ebbcda273338d9c9ae08cb482bbc6d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_62ebbcda273338d9c9ae08cb482bbc6d_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX3840.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3840.tmp
Size 1.2MB
SHA256 c51fa69081153cfd29c5a3a360edb540dea1afaa8eb07b69a8f9660c3e601e2d
MD5 6a5436f3bb2dbdbb76163ebbef8905ac
SHA1 d838453c1db4b3cb36f66f6953646eeb4519528a
SHA512 1bfa9bd7b81c0dec163b7e77e9535ea8d796b8c98ce13700362fd3797c2b8036bff3cca90a55adff4a7d99b98b438044c2e6f67e4bf4c6c211f0b5fdc9da0b5e
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOSIYA+w/P:I6F0eMpAAYEhpDhw3
TLSH
T1AA456D54E743C9F5ED2700F0444BE7FB65319E1988318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 371ebdfe6bb114019df5cc1dca3097b34f60c965f04c73a3a96381f17d3bc07d
MD5 5ef9e06924b8e2e16a727404de44c315
SHA1 2c064562de697d244675623e228f7f82fc66b568
SHA512 5dbf2b30a9647d81ff60f743fcd3718f7875a1fac254b0b8b732032d4216100f0b22d96f34e5d5adcd9a7f7d6c639c5b2c4ba05b000f9d611c4b652eda4a2558
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPIYA+wy8:Q6F0eMpAAYEhp2hwf
TLSH
T144456D54E743C9F5ED2700F0444BE7FB65319E1988318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 232e7d9f1607ba0be15864ad510dce49bab787f00c1d3d5738c19138d04c475d
MD5 ac535c088b3a8ce7d2ceb65537be9d17
SHA1 15d6f86465b89417e05ad888c8047b0e2db25cd8
SHA512 23c71331e027c8b3b35f7ccff1cba832c9a198e8b51d847beaaefbf29cc3d92a1c73376926962f31bd35faf027ebf9fcea4d9183874d449c8df5169edc936960
SSDEEP 24576:H7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOIYA+w/X:M6F0eMpAAYEhp/hwf
TLSH
T168456D54E743C9F5ED2700F0444BE7FB65319E1988318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 4986f742a68f468f08797fc7274318eeae7c2b63f8600978b6300f9adbc979f3
MD5 d8d275c9484ad1a80c2470e1ced4f942
SHA1 5f71ca2b5b278aa81316d06c0c8ed5333974cf68
SHA512 20a7838643826154f3d878be9b1b4680ad77896b79461bb0c52d1e9d85536b71936010021946209df661aca0bb1f9385c0722b996c6d7c7e30ca2518b689bcc5
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONIYA+wOS:46F0eMpAAYEhp8hwB
TLSH
T123456D54E743C9F5ED2700F0444BE7FB65319E1988318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4880-153-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads