294c60692a5a2a3bbfaf84d559c7eea6e3bc3384f1b2d5982bb8615c5286ecb2

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1a700c881d7c9dab0786f82088b25054_elex_wannacry.exe
Size 1.1MB
Sample260808-elpassszet
SHA256 294c60692a5a2a3bbfaf84d559c7eea6e3bc3384f1b2d5982bb8615c5286ecb2
MD5 1a700c881d7c9dab0786f82088b25054
SHA1 41e416e916bb1ecdda3c358e2a88afcad321fd29
SHA512 9601c4bed1224c38c8e37310784b77d450ef89223e5c7a6853474d13e4a8c37c057cf986a3606ea04c344bb858a9803e7779c7d705fd3a0c14dc03e165944607
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+w6Ld:W6F0eMpAAYEhpKhwUd
TLSH
T117456C94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
920	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_1a700c881d7c9dab0786f82088b25054_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
920	original_temp.exe
920	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 920	1748	2026-08-08_1a700c881d7c9dab0786f82088b25054_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1a700c881d7c9dab0786f82088b25054_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1a700c881d7c9dab0786f82088b25054_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXD976.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXD976.tmp
Size 1.1MB
SHA256 eda0ed0e58c1fe30d3a2d37a591107903ae25ba18b4d173badc52f897683386b
MD5 e5fc78a03b07982b76dc50af977456e5
SHA1 108b4df725098e525a75f90608f615cce82474b7
SHA512 85233ba3b9847e38e2294f3d68a01da399a59a64cea405969ddcfd94f07f2367ff27bda40b57cddeef06e4e18f6b33ab677e9710b7bb93c74d1e26aeb3f41385
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+w/j:N6F0eMpAAYEhpuhwr
TLSH
T148456D94E783C4F5ED2314F1444FEBFBA5309E1940318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 8c0546976cc173ecf0eea345c692adaf87d55a6167974ff28a469529975f0124
MD5 d5f870953969e2a879e0fe8ac2e13193
SHA1 b650ac64002bccbe69ad1a284cd29d5f1f0fc978
SHA512 93ee5a9ff208d083e70b18fde04bd42dc427cde8f922f7c6dedcc8e4ee09812235a25bd3d295b58248a6dd8018b57424464855111af68f5fd9bb60ec71a35179
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+w6L:W6F0eMpAAYEhpKhwU
TLSH
T15A456D94E783D4F5ED2310F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 84d011365fe6a53fd1ef3ceef1913547885d2d075001899dc1f9f76ff719128b
MD5 82213b904e5bf0c8a21e3e4e076d7906
SHA1 b16b3de965fca0f3f578236240683c015eda0d8c
SHA512 d645968e63de187367a68e17a1e2d975e3017b2c199796c514fd660cc5f732d41217da8a6cdaa79b7455888b8eb1f13d536dbe3126eb5b85427fed43ec06b20e
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOhYA+wGx:e6F0eMpAAYEhpNhw2
TLSH
T12D456D94E783D4F5ED2314F0444BEBFBA5309E1940318D6BFBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-155-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads