30ca9764f638d9fdaa3919772737d02df52afa1d61ca21aba9648376d4421ba6

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_f31b29eaf2608837e6e951f8f97c4e3b_elex_wannacry.exe
Size 1.9MB
Sample260815-sdtgfayzd1
SHA256 30ca9764f638d9fdaa3919772737d02df52afa1d61ca21aba9648376d4421ba6
MD5 f31b29eaf2608837e6e951f8f97c4e3b
SHA1 301b3d77e1e26a178163c891eb8ba3190e480d84
SHA512 0f21860c69542663f9c428bb884fd843b6639c33c22d35d2943eec0280ac3bdda6d302909edfa048d8f03f407a3d52174adc1ce59ad23fb552e8ad765b847141
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO2U4UUU3UUU3qX+a:n6F0eMpAAYEhplU4UUU3UUU3qua
TLSH
T116953AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1684	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_f31b29eaf2608837e6e951f8f97c4e3b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1684	original_temp.exe
1684	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 1684	5920	2026-08-15_f31b29eaf2608837e6e951f8f97c4e3b_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-15_f31b29eaf2608837e6e951f8f97c4e3b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f31b29eaf2608837e6e951f8f97c4e3b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4BE5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4BE5.tmp
Size 1.9MB
SHA256 c25d3f293898f2b8d0dae6613b0941ae76da41a98aef5d78ecd02dc7a788ea62
MD5 fcb39bda3a3520eb8d6573bdc1d0fba4
SHA1 f942db472149ff7446358c3433006fd9291e96c0
SHA512 432f4a9ee546004b43d7ba64f3df6f39f80ff47c79f0ef6d89b7fa80f3fb9d0da3a463bc3251916e2a13aa506b297407bc2d87f770f9ce098421d93666f25ac9
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO2U4UUU3UUU3qX+:n6F0eMpAAYEhplU4UUU3UUU3qu
TLSH
T130952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX500E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX500E.tmp
Size 1.9MB
SHA256 6511d2a2760a1d3d3b239dda3d1723d406b806264abbbe4a246050e0ec2fbb11
MD5 c60826f2759076f8962c505b0e50c1af
SHA1 98f39d730e78500a2cf20e0bc48a2007513e7800
SHA512 37180b638cf721128d89796d8201da64bfb112e7168bb6c420a4c59c881a368636941cac98b3f4facd4bfe0deb48ceee95289bc682362c709c8440bd3a36d6ef
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHU4UUU3UUU3qTL:D6F0eMpAAYEhpEU4UUU3UUU3qv
TLSH
T14E952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 eb2b71204a152bbf5e18f9b17c2040507b0aa54ed7ec3422a2f08088cbd4bb13
MD5 a3ff731206a75c7fab8a9f63b56fab21
SHA1 d5d4c9cf62bc90053ba3280ddcc03a2fe1a6ee49
SHA512 e5d980fb07a83186dbcb6c40cb10d9cf141511d74d8c7e288e1f0c7e6f320304ab98f3f1cc3b4fe86a6a0fd237884ee357acefba50f881d236592a3f204b399e
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOCU4UUU3UUU3qff:X6F0eMpAAYEhpFU4UUU3UUU3qH
TLSH
T157952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 fb2d112302a9d7237b18cebf3676ad06afe36304756f979721cce4241439c98c
MD5 0bad6e2e928b26ccff0307606beca0de
SHA1 e864a5d02abdbaa8edbe604fe3200366288c03b2
SHA512 effd8d55d5dd9b2d8873e96b8b3bb3bcc5482c4afbaa037498018e3ca20de77f1683ace2b8e656179fd4190dbbe26f6a156323c46f5a07d71c6a7bb49363e48f
SSDEEP 24576:I7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO7U4UUU3UUU3qTT:D6F0eMpAAYEhpEU4UUU3UUU3q3
TLSH
T130952AE5FF42B0F4E8934CF1350BF6FED5236D2988228967B687FB28B5736212519106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5920-152-0x0000000000400000-0x00000000005F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads