0aa05b4b02b71a5006822048fa0ec3120ad1900e2d513b86ee6c4d6beeb925ea

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_366b992f9c278013b53e9abe516e7536_elex_wannacry.exe
Size 1.2MB
Sample260804-pm8e6szhle
SHA256 0aa05b4b02b71a5006822048fa0ec3120ad1900e2d513b86ee6c4d6beeb925ea
MD5 366b992f9c278013b53e9abe516e7536
SHA1 de44278290a0ed98f2dd15b34a3702dde153ea01
SHA512 7cd43136a72e1af6d7bc2d60ff3d01f06fdf013b4e4cbd35e8e95ab4922071da0ffd2cc223b560361ff30c1e5897e56a0bb4b12e9b6c269c79926af42ac0f82a
SSDEEP 24576:lt7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOf1YA+wH9k:Y6F0eMpAAYEhphhwdk
TLSH
T19A457D54E783C9F5ED2700F0444BE7FB65319E1588318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3784	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_366b992f9c278013b53e9abe516e7536_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3784	original_temp.exe
3784	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3784	2384	2026-08-03_366b992f9c278013b53e9abe516e7536_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_366b992f9c278013b53e9abe516e7536_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_366b992f9c278013b53e9abe516e7536_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX315A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX315A.tmp
Size 1.2MB
SHA256 7ebea62a84e9318c275ee503271fb523ef33c8155ecb885e6ab55739eab5db35
MD5 859fd79bf5aecb1d157c02ff24f46887
SHA1 a12e1893a88d885de2ba1a4f2e90f9d4b1e3f620
SHA512 e04964a6ff4ddb7a4189bcebb5e6ee317f4ab44673eddfc1b1e61216a2478c7a2556c6d1b49f186f9be70ef8c08db187145191dce3ba7fb951d8d0fb484ff1c2
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOb1YA+wmV:n6F0eMpAAYEhp5hw+
TLSH
T15B457D54E743C9F5ED2700F0444BE7FB65319E2588318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ea1bad3936937c86f79a16e793257fa8b788998c0347eab0b5991eba1ebd49de
MD5 38cf408052486f0ba191a20157aa9cf1
SHA1 3edbd6062d5c7743c8e3aa40161c112db49bb16e
SHA512 36a511b87bed17fb964e22c7a8d9896705b3ddb10458d6d4ebe6bfe02f0c79e0dc896ae3957a67cf7f853f0f9db85b8053f42a683bc375e34b9eb983d855215a
SSDEEP 24576:lt7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOf1YA+wH9:Y6F0eMpAAYEhphhwd
TLSH
T15B457D54E783C9F5ED2700F0444BE7FB65319E1588318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 a6c970e55d1ad444bbc0559782d8d44788b43b85502cf122d826ac80766647f7
MD5 c8eb6d2e9169bdbfad41c3a2bacc8c82
SHA1 f469c22ef7ec4a45c0aa58c8b84c807a8ac660d3
SHA512 d93daac149f9cb68f922afa4534c0b7ed44a7967fcfbe32eb6feb036f1400c9acd65e2a210d0cc96028cf3291fe3fa6f4c167ee66c8f9b0d3453e1693810f641
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOg1YA+w/m:U6F0eMpAAYEhpwhwO
TLSH
T1AD457D54E783C9F5ED2700F0444BE7FB65319E1588318EA7FBC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2384-151-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads