a5271782888955a5d5516ff03a83163c28067624874a6763e4d2c51ea33b14d7

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_0c45183a36a27f6c38089f4dfd6124ee_elex_wannacry.exe
Size 1.2MB
Sample260806-ccwbmsfc54
SHA256 a5271782888955a5d5516ff03a83163c28067624874a6763e4d2c51ea33b14d7
MD5 0c45183a36a27f6c38089f4dfd6124ee
SHA1 40efbd6d69b0694b26a44d3046ff752a9e6889bc
SHA512 e445f401de4fc71c62948987a7de5444d146142cfeb6e87a6fca35482a72fb3b7a9efd8f77203ca92d640891a832a0eb3d0fb8529b98ba76a9cbfaf2b3daecd5
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpU4UUU3UUUm1YA+w/9H:O6F0eMpAAYEhpyU4UUU3UUUhhwlH
TLSH
T1C2456D54E787C4F5FD2314F0444BE7FBA5309E2980318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5416	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_0c45183a36a27f6c38089f4dfd6124ee_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5416	original_temp.exe
5416	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 5416	556	2026-08-06_0c45183a36a27f6c38089f4dfd6124ee_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_0c45183a36a27f6c38089f4dfd6124ee_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_0c45183a36a27f6c38089f4dfd6124ee_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXE75C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXE75C.tmp
Size 1.2MB
SHA256 3f7fdb61e44205d1c047ca0f65a626f785574104b2164a98740bdf7383d80149
MD5 cc9c49dfdb523cdff095313696bcc048
SHA1 c0971bfd058175bd42ecb8f5639e95921d6d08ef
SHA512 de0d6a4db1d34334e11d28930814be2ed32b1f2af0679f1c3bea1f615dd512d4cebe627fe7c7c24064b7988129adb71b6bead746aa7cc67984a7e5e39a2ade9b
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgU4UUU3UUUm1YA+w/V:l6F0eMpAAYEhpHU4UUU3UUUhhwd
TLSH
T183456D54E787C4F5FD2314F0444BE7FBA5309E2980328D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 8e5a6d8f5ac501ccda7cd1ba754fa40a041be835c471450e4a4fe2e0fcf139c9
MD5 d1080bfd53ab06af32b39e7c513e9944
SHA1 a8db7d2b6f14922cb41192a02a27d8013557cf4a
SHA512 386063b257580b2a1f9f56f92920cd5b2a9a764a2512cac68d54cf1973c6bd8d58df3e5ed6d3c46aeb06533a9e711c97b937a86e40a34698eccbd36a643c3d91
SSDEEP 24576:17VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpU4UUU3UUUm1YA+w/9:O6F0eMpAAYEhpyU4UUU3UUUhhwl
TLSH
T140456D54E787C4F5FD2314F0444BE7FBA5309E2980328D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 8e204f863221d271483830dae9e30a19a545749d7536b6b93b243e14a20a6d0a
MD5 0847ae08af2d7fbcd4daa6743f709e60
SHA1 ca262ec1bc9c5e415549278b9bf44f083d6fc59a
SHA512 a27a735f9ddd4c882570453c5c2255bb8441e59f06cb627769f8fffb4c3889e30cb408d6bab1edbc2bc3d507b85c7aa86ccda4728cfc792de0a61b33c0ef9165
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO1U4UUU3UUUm1YA+wr6:u6F0eMpAAYEhpKU4UUU3UUUhhwm
TLSH
T198456D54E787C4F5FD2314F0444BE7FBA5309E2980328D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 0b0cbee75e956382f2d23df6d8396196f0746ab0cfc6af65b990c356776dd9c8
MD5 d635238e47670525ff7a036bc80d5124
SHA1 68f970da353792695e0339c9667b70ab6942cc89
SHA512 f79cca5459198d79f1ccf17fe92ce7ec5235857d8e98b4e9c5a3e0d96c22a21a4bce2a2386851ac193250ad6aee0238c3895107695910574d8f0357d211f0750
SSDEEP 24576:B7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOYU4UUU3UUUm1YA+wCE:S6F0eMpAAYEhprU4UUU3UUUhhw7
TLSH
T16C456D54E787C4F5FD2314F0444BE7FBA5309E2980328D67FBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-155-0x0000000000400000-0x000000000053F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads