01f2c3961f8ba521d876bba9e071e2f1410c5e45382679da3881a1f022571562

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_89f1813c3b31aa27019293cf049ad258_coinminer_driverpack_elex_wannacry.exe
Size 3.2MB
Sample260820-pgb5sawgmc
SHA256 01f2c3961f8ba521d876bba9e071e2f1410c5e45382679da3881a1f022571562
MD5 89f1813c3b31aa27019293cf049ad258
SHA1 b33bd07351f642cabbcd599e4957d454e0afe07d
SHA512 8f5db2568487efb73c0fc7a46281867c9c965c1618be1a92cba4b8212a501ef620766ae718c5c3cd080b3f648ec0c5a023794dcc1b09311ed0f11442e881dfa9
SSDEEP 98304:W5aFJwSjbuwJurWW6GfhNaPExgLBcdBq8M/tb:W5aFJwSjjPtWo2gabqt/tb
TLSH
T1C1F5330035A78271E5D363312E04ABA7E5B0AD354B7E97CB8BA13E354F761E1BA381D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4188	powershell.exe
1144	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3000	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4724	Setup.exe
3276	7z.exe

Loads dropped DLL 9 IoCs

pid	Process
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
3276	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe
4884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_89f1813c3b31aa27019293cf049ad258_coinminer_driverpack_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeIncreaseQuotaPrivilege	1144	powershell.exe
Token: SeSecurityPrivilege	1144	powershell.exe
Token: SeTakeOwnershipPrivilege	1144	powershell.exe
Token: SeLoadDriverPrivilege	1144	powershell.exe
Token: SeSystemProfilePrivilege	1144	powershell.exe
Token: SeSystemtimePrivilege	1144	powershell.exe
Token: SeProfSingleProcessPrivilege	1144	powershell.exe
Token: SeIncBasePriorityPrivilege	1144	powershell.exe
Token: SeCreatePagefilePrivilege	1144	powershell.exe
Token: SeBackupPrivilege	1144	powershell.exe
Token: SeRestorePrivilege	1144	powershell.exe
Token: SeShutdownPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeSystemEnvironmentPrivilege	1144	powershell.exe
Token: SeRemoteShutdownPrivilege	1144	powershell.exe
Token: SeUndockPrivilege	1144	powershell.exe
Token: SeManageVolumePrivilege	1144	powershell.exe
Token: 33	1144	powershell.exe
Token: 34	1144	powershell.exe
Token: 35	1144	powershell.exe
Token: 36	1144	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeIncreaseQuotaPrivilege	4188	powershell.exe
Token: SeSecurityPrivilege	4188	powershell.exe
Token: SeTakeOwnershipPrivilege	4188	powershell.exe
Token: SeLoadDriverPrivilege	4188	powershell.exe
Token: SeSystemProfilePrivilege	4188	powershell.exe
Token: SeSystemtimePrivilege	4188	powershell.exe
Token: SeProfSingleProcessPrivilege	4188	powershell.exe
Token: SeIncBasePriorityPrivilege	4188	powershell.exe
Token: SeCreatePagefilePrivilege	4188	powershell.exe
Token: SeBackupPrivilege	4188	powershell.exe
Token: SeRestorePrivilege	4188	powershell.exe
Token: SeShutdownPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeSystemEnvironmentPrivilege	4188	powershell.exe
Token: SeRemoteShutdownPrivilege	4188	powershell.exe
Token: SeUndockPrivilege	4188	powershell.exe
Token: SeManageVolumePrivilege	4188	powershell.exe
Token: 33	4188	powershell.exe
Token: 34	4188	powershell.exe
Token: 35	4188	powershell.exe
Token: 36	4188	powershell.exe
Token: SeRestorePrivilege	3276	7z.exe
Token: 35	3276	7z.exe
Token: SeSecurityPrivilege	3276	7z.exe
Token: SeSecurityPrivilege	3276	7z.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4724	4448	2026-08-20_89f1813c3b31aa27019293cf049ad258_coinminer_driverpack_elex_wannacry.exe	88
PID 4724 wrote to memory of 6124	4724	Setup.exe	89
PID 6124 wrote to memory of 1144	6124	cmd.exe	91
PID 4724 wrote to memory of 4884	4724	Setup.exe	93
PID 4724 wrote to memory of 5932	4724	Setup.exe	95
PID 4884 wrote to memory of 4188	4884	cmd.exe	96
PID 4884 wrote to memory of 3276	4884	cmd.exe	98
PID 4884 wrote to memory of 3000	4884	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-20_89f1813c3b31aa27019293cf049ad258_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_89f1813c3b31aa27019293cf049ad258_coinminer_driverpack_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448
- C:\ProgramData\Launcher\Setup.exe
  "C:\ProgramData\Launcher\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract2.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract3.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4188
  - - C:\ProgramData\Launcher\7z.exe
      7z x Launcher.7z -pool=77
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3276
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall set opmode disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3000
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\ProgramData\Launcher\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\ProgramData\Launcher\7z.exe
Size 562KB
SHA256 83967f1b02b43c4efeda302795722c809e0e81b8307de73558d10484d5676a7d
MD5 0355ea40d9046173bb1435b41bfc118e
SHA1 abb27eaed3b878a16ebe5463301b9d70f4580b76
SHA512 cbc0d427f14bd6ba67caf6e6e279a381f96bcda72fc26df4c3f8083f63ca8b9d3b0ff4d38971b346f1f1f3e5eb1e5c2d95b42c933f9fad98746d8b25b62190f5
SSDEEP 12288:t5xAeJRYzx/uXbpb7ykox5r6f5y82XpdC8t:uIYF/EJy2zIPt
TLSH
T1C3C4F726F6748335D073C0B9C5D2A69AE97130865B308ACB4286C77C3F676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.7z

Path C:\ProgramData\Launcher\Launcher.7z
Size 1.7MB
SHA256 aae3ee9f6082676d2d9035d7b6beba659d7444554d0b96ae00113409ce1b49ad
MD5 a75a4fda04f109dd5da1827f48250811
SHA1 4d78908c312dba68341d707fe4903661952cbe0d
SHA512 554d2201424ee1f9366fced16f96fa4f8c16c7aeda32a925f8d68d7457817a55d7637b0f8393eda845b543ddb40825682ae20e9a390e9b29a3e0c7f43fa56a6b
SSDEEP 49152:PyDBvle0bu+D81GXAS/iHmy+Qzg7ZYSmsDAk8:KNdbbu+agxM/Sm2Ak8
TLSH
T19F8533883123D722878AE24B6F34CB9BEC70FD54977FE3578AD64E748A8D16875100B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\ProgramData\Launcher\Setup.exe
Size 34KB
SHA256 8e347ef52c18a9f479a5d82729de5b4889e1e4ad74b7dab6ac17183882c5b4bf
MD5 1d7c6066058c4b69c5a144c74f839f52
SHA1 f46fd60cc3a1980d685adc53ade5baa3484e615b
SHA512 b830bbe16c175d953ccab63ca38f7b527b358508f436107b488ebf1d41fab7f27bf91d0160baa2519259d71c4bddee9ee5e098ae8307cea951e6c211dff75c3e
SSDEEP 384:IiannYJLOKiXyWkn3BX05x4GGY+hoUGxaQAwZ0oK78hUZZZgYa8IFDAcM8:IpnKO3X4n3BX0v4cFqkhUZZZ3DIr
TLSH
T1EDF2C541AA1C05F1E961DB39192FDF02C765BC3A9990E16762EE3EDA99F1050133BB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extract2.bat

Path C:\ProgramData\Launcher\extract2.bat
Size 84B
SHA256 4d30e07de90e884457243e8e4a20ae5b960890212792581944d1510efcb98e61
MD5 f188dec7ed26b4d829969675090e1e3c
SHA1 308d36faefbb1cffe217345340c93a6647157849
SHA512 826206d55e48e4a0caa1661491e7db106f8032b2a8e96d075d8d2674478da99697554f9f9147a50f45ac1292388ba98971bebefdf9dc9bc478d2bb3b85e36daa
TLSH
T1F9A01222011840DD8BE90458F011054A248B8020401F009331289C08190053CD3B9C0C
MD5 SHA1 SHA512 TLSH

Submit Download

extract3.bat

Path C:\ProgramData\Launcher\extract3.bat
Size 152B
SHA256 0075dee650a31a4e9911743f33e01b79db7e392105725499cda28928ccc6d6b4
MD5 8bedeb85d87b182f0b55a06b20fdb8a4
SHA1 7f581191766e62ad467417ccce7113497c1e30ad
SHA512 66b137cfebe9f75f3a264b96b9ee17727d02a04c88d739edea6a5128f8da4fa350754ff334e3cfb02927dbb3cef841032af5e793b01ec891681edc903abf07d5
TLSH
T1ADC08C15009A0046FDB0AF644228031CD20B827A602E80B63839CA05254EC6CE674D04
MD5 SHA1 SHA512 TLSH

Submit Download

rtl70.bpl

Path C:\ProgramData\Launcher\rtl70.bpl
Size 766KB
SHA256 a2c9f2055886327d03724c2aef95566c9a731f83b568ff88c48ccc0dc74218f0
MD5 123015c8c70d81aff1e6d3b316ddf00e
SHA1 a401df86057c3d8cf11fb1dde177fcb549433145
SHA512 550e8d1ae8f1994765cf2310519b45ec87331ad72b5004f3feb1a0291070044acde37841e3f44195a021256ad16d294665edc9d44604bca2edcd4ef604d4ad5d
SSDEEP 12288:RnJoCnL9vbHcONNBbiaeV/PzUW6SIg3N8Ts0urVyU08v/fHTE/JW+A9IpDNOej3q:RnJzdH9tYG8vHkW+A9ITOej3+Jr2z
TLSH
T185F48C21F24889FBD6B3273D451DBE37C5B97E209620CEDA69F84D49D9605803F283DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl70.bpl

Path C:\ProgramData\Launcher\vcl70.bpl
Size 1.3MB
SHA256 976e20f397d19ba3b5b3347a3299c061ca325b7b915a46baf6e57cce5779a9cf
MD5 563e6aeeb20c98bc1f8917ec3f04a0ac
SHA1 82678ab71e3eacd679a0137d1b46eb3bab87c050
SHA512 bf7ebe2a5746c6347d880eeb9b4c225a7641f206c6f9e6cac6b2da4b95110ff05af652c1c71d5cebafc0e8e09100e861b6b6962941e9bce1b2873510300fca15
SSDEEP 12288:eYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjjgOby17fG:oof30jJBpSfZyWIGBsKHgObC
TLSH
T1E7557C51F2280CB6D4A757BC2A7F7F21D965AB106260A78E3AF48C5C5EE2D803F5134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 01791c2e4a0cccc6234ea673646496f473ed74b61f779467716f3dcb748b37b7
MD5 0a40722c3b98289c25c8292bcf042308
SHA1 f875a902d2428a14a47ead098ad3df7fef43c164
SHA512 3de7f5c232fd7f35fb64435c94c084c2c75119f9f781064a0a361f81ea38b1aafa22b0b3eeaacaaf8fc635b7ab1740ed863256efa3ab34b3d02416f8dc24ed94
SSDEEP 384:S1eBaoT1iBGmH4SqUcbk33f3E4y15P4oiKuL8d8JYQhi+9YPgUCm:SexZ6GmzqXkHOwHPL8dMWSmam
TLSH
T173A2C422538F6F6DF16B7F39C5F948539F15236EEF81B4822B3854080972A92EF83945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_amheb2df.mvp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amheb2df.mvp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-57-0x0000000007280000-0x000000000729A000-memory.dmp

Download

memory/1144-41-0x00000000054C0000-0x0000000005B0A000-memory.dmp

Download

memory/1144-48-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Download

memory/1144-49-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

Download

memory/1144-50-0x00000000070D0000-0x0000000007106000-memory.dmp

Download

memory/1144-51-0x000000006EEF0000-0x000000006EF3C000-memory.dmp

Download

memory/1144-54-0x0000000006500000-0x0000000006520000-memory.dmp

Download

memory/1144-55-0x0000000007120000-0x00000000071C3000-memory.dmp

Download

memory/1144-46-0x00000000053C0000-0x0000000005426000-memory.dmp

Download

memory/1144-56-0x00000000078C0000-0x0000000007F3C000-memory.dmp

Download

memory/1144-58-0x00000000072F0000-0x00000000072FA000-memory.dmp

Download

memory/1144-59-0x00000000074F0000-0x0000000007586000-memory.dmp

Download

memory/1144-40-0x00000000026B0000-0x00000000026E6000-memory.dmp

Download

memory/1144-47-0x0000000005D10000-0x000000000606B000-memory.dmp

Download

memory/1144-42-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/1144-43-0x00000000052E0000-0x0000000005346000-memory.dmp

Download

memory/4188-78-0x0000000005B20000-0x0000000005E7B000-memory.dmp

Download

memory/4188-84-0x00000000072C0000-0x0000000007363000-memory.dmp

Download

memory/4188-81-0x0000000073710000-0x000000007375C000-memory.dmp

Download

memory/4188-80-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/4724-74-0x0000000002510000-0x0000000002668000-memory.dmp

Download

memory/4724-63-0x0000000002510000-0x0000000002668000-memory.dmp

Download

memory/4724-62-0x0000000040000000-0x00000000400C7000-memory.dmp

Download

memory/4724-64-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/4724-73-0x0000000040000000-0x00000000400C7000-memory.dmp

Download

memory/4724-72-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4724-61-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4724-31-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/4724-30-0x0000000002510000-0x0000000002668000-memory.dmp

Download