fde9fd5603931ace5944c1bd77c6b086fdfd5faa807a8e2de3876953642c6e4f

General

Target
2026-08-10_cf3c69cd25763d3e793b5b504a1a50b6_elex_wannacry.exe
Size 1.2MB
Sample260810-cbq1jade37
SHA256 fde9fd5603931ace5944c1bd77c6b086fdfd5faa807a8e2de3876953642c6e4f
MD5 cf3c69cd25763d3e793b5b504a1a50b6
SHA1 5e57cde7fa528813181759d394b1ea7a8d6f73dc
SHA512 4b9988cb898267e6db593912fae9aa49c865402142f333d0f42e37d0f05c61bda57b3fdc4a2121e2d9381fc247fe93b6da2547c7468db9155a52ed645b3e5711
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQYA+w+Lo:a6F0eMpAAYEhpWhwMo
TLSH
T1B7455B54E683C4F5ED2310F0454BE7FBA5309E2940318D6BFBC8FF11BAB2E522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3448	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_cf3c69cd25763d3e793b5b504a1a50b6_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3448	original_temp.exe
3448	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3448	1288	2026-08-10_cf3c69cd25763d3e793b5b504a1a50b6_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-10_cf3c69cd25763d3e793b5b504a1a50b6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_cf3c69cd25763d3e793b5b504a1a50b6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 5b8eff37e1476958bc577e032c3d840c45ca1531bfba0c058057db49d9a04ad1
MD5 f6ce408289076bd84fd39baf52c45840
SHA1 7ed2fd274e1e860252ac5e64a1335beafa0621f4
SHA512 a595d3955d2f356374e1107832be531cb5e0b8ceba89f783a360ce3a30b5ccf10630dddf6459bb9582d2e5b61a5c3ef52d53d1aee2074b8888aef224e834429c
SSDEEP 393216:gOlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vX3:giWO1c877xqpyovvVWJ6VFK+q3cSvX3
TLSH
T1885712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF981.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF981.tmp
Size 1.1MB
SHA256 e91def2854cdea05628af8b6367bf78c2d0c11294be2ec5674fd7c3ba8cce52c
MD5 7439c3ef5d399345bcdd17e376bffa9a
SHA1 6a97faead1ad95b8d9bd54841022b658d9ee6203
SHA512 f3d8d094635aa5f09e059bfafe4bd97e326c1505c99f6da224b58305100f39fbb14038c4029c6bdc0b747896a86701f546d003284cfdef1e85c38a3f4f28a4f3
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnYA+w/f:w6F0eMpAAYEhpfhwn
TLSH
T13B455B54E683C4F5ED2310F0454BE7FBA5309E2A40318D6BFBC8FF11BAB2E522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 80f8617e865510c52edcf2425ef08ce7b0f4c61027efe36a4ed703e7fd338067
MD5 4ffacb6f9093c4532208411a1227abe2
SHA1 450424ecd925d7ee4f2bb8c0b9b76dad71c99646
SHA512 122563117001d686e90ed1beb0c74c0e2f96ef712cabb86ece38a1124a33632e3cc5dc7971131602ed0d6cd797871980907c3591047c3d9e193d7bb811dd0212
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQYA+w+L:a6F0eMpAAYEhpWhwM
TLSH
T19B455B94E683C4F5ED2310F0454BE7FBA5309E2940318D6BFBC8FF11BAB2E522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 43dd1074729bdd50cf37cb4d1684f369bd25f82913d85bcecf8bad5fd97dbf87
MD5 aa1847082d11f334acc2f81bac1a5bc1
SHA1 c0f9f9acee6a08dd7ffdfc0fb71b7269559e031d
SHA512 03086c45586f4db9176e76d747bf8008e6ea8e8120db105c056da65c026b2abf9b706951771340a7863db0bfb10c7e20e66bca2729194328fdb6f4103f63386b
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/YA+w/H:i6F0eMpAAYEhpzhwv
TLSH
T19B455B94E683C4F5ED2310F0454BE7FBA5309E2940318D6BFBC8FF11BAB2E522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 1cc08df3dba63c804140043237db87ff4b626193f8878c809255c79c9f0cdc25
MD5 ee4a39cd4126813530624a7832ceeaa2
SHA1 8ca669bdb7115157caac994eede9b76c2a0e3005
SHA512 d115f54e1f5d655b28dc95dd3b2fb7d89fb9ab15bb734661f5119ea536dd67e13cf4d9cfc0b9c781abd6f4c08c5b4a232d1055cae026b1caeca73ee7af131d1e
SSDEEP 24576:Z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8YA+wSI:q6F0eMpAAYEhp+hwn
TLSH
T1E5455B94E683C4F5ED2310F0454BE7FBA5309E2940318D6BFBC8FF11BAB2E522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-152-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads