e0dd5239a5cb4bc500f92fd0c9d67d3705d9adc72c590767d2442ad7729bfd8c

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe
Size 1.2MB
Sample260808-eellbshk7v
SHA256 e0dd5239a5cb4bc500f92fd0c9d67d3705d9adc72c590767d2442ad7729bfd8c
MD5 3388d8c8aab1bc7475140a3d6975fc91
SHA1 15f4490b33c23ef0415a2aa149b69278843ca607
SHA512 8ec891a26299c64d79a31d4188ac9e2de6119eb75fd8b018199a4f9c327259ab4c8f96b1f14fba7f37200503f1dbbfe78032ec4ea283641027192cd319635ad7
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrYA+wWtU:K6F0eMpAAYEhprhwGU
TLSH
T139456B54E78784F1E93310F0465BE7FBA6349E164032CD2BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
992	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
992	original_temp.exe
992	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 992	3412	2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3388d8c8aab1bc7475140a3d6975fc91_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX34E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX34E2.tmp
Size 1.1MB
SHA256 2ee60c0115f97364aa1cec531c39f0103f5e631373dd8dcb51fa280c09015dbd
MD5 2f4eaf36ea5ef599c42bfae778a87581
SHA1 7c7a5e09d90944219e4b07a7d1d77647f407379d
SHA512 256da2a54882aeadbd840f3a4b36483d406661b2fbb5d7d527afb0cc59650cc94d1861f363570fa36f5586cc29cefc7405427e53a0dfefeb54f56d8d1aa84c29
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrYA+wWt:K6F0eMpAAYEhprhwG
TLSH
T116455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3707.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3707.tmp
Size 1.1MB
SHA256 9bfcd145f5166d1896ed16275b097df3e21e85b97020b116a829996ba13734ee
MD5 11ba1012ef0a94165820bcd53f5f55b3
SHA1 6102993945bcc4834e3b4590774f4766f8484e3d
SHA512 1f4c9a10aed1ff7c86548142b1926afa28f5148c78d0972571a2a508f27eddc6957443008620f87acbe084c289f2ebc8ae3e7ad91ca27843c335602e063f31b6
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPYA+wvQ:I6F0eMpAAYEhp/hwY
TLSH
T12A455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 98c09947dc72db84a0a9ab15e8594493221c64fa889acf1b5ae67a8ff65459e0
MD5 0757a50a91ffb6f851c15abb7fdb4409
SHA1 6afaf460f9fff5875f0127112cda23044c25e89a
SHA512 c4e5e6b4f6cdde4bfff0b320afaff9f370120d308f9adb45bcdc9b3f57802d727a6b1dfa6b992f2cd3dbcfeb4489198fb334aba9e13551cac0ff6dc08588716d
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxYA+w/3:K6F0eMpAAYEhpZhwf
TLSH
T16C455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 51c72fdc65a81a63f8a716654994c2fb91bf233bcdbea23d78862f83160431cf
MD5 2bae5a8f7b5155a07f8fd6ac30875152
SHA1 f9e99055a26e2d8c71bad6eebe0afb7386c2f10a
SHA512 39f41d82b74e51c07568675025b381ac77d6ebcae07b6ba27dfc43f8943ed01f103598d12c4029e7e815ed3f458b041da7b283ab6eedc6216699051ec154d4da
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORYA+wvo:e6F0eMpAAYEhp5hww
TLSH
T1E4455B54E78384F1E93310F0465BE7FBA6349E164032CD6BEBC8EE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-152-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads