a17c6bcf844adcb1d84b0b4b3ac744e628dfcfd7489d8768950e63edef2a372b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_1f12b6289bf4f0d9a11f7aa5aa0e3943_coinminer_elex_wannacry.exe
Size 39KB
Sample260822-e71wqavycx
SHA256 a17c6bcf844adcb1d84b0b4b3ac744e628dfcfd7489d8768950e63edef2a372b
MD5 1f12b6289bf4f0d9a11f7aa5aa0e3943
SHA1 0a7751a018f9fb491f683b4f90f5c1ce39101a43
SHA512 6ade3843e0bf344555698cae0e4b87e814a083705e18683ada54bbaa47a38577a9284773848299ca82ed4b13ab8c4a73e566841eee633c5d6cfa3de0a8858966
SSDEEP 768:5lZY4hyZYz+ha3Ludn8b3kZzeAszGkUkLZmz/+S:7NhyK3ILoTUkL0z/N
TLSH
T10303C003FB6988AED390DE3216EB5A7A9D75F9104A58430F27A5ED4EFD313598C0230E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1912-0-0x0000000000400000-0x000000000040C000-memory.dmp	UPX
behavioral2/memory/1912-1-0x0000000000400000-0x000000000040C000-memory.dmp	UPX

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_1f12b6289bf4f0d9a11f7aa5aa0e3943_coinminer_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1912	2026-08-22_1f12b6289bf4f0d9a11f7aa5aa0e3943_coinminer_elex_wannacry.exe
1912	2026-08-22_1f12b6289bf4f0d9a11f7aa5aa0e3943_coinminer_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_1f12b6289bf4f0d9a11f7aa5aa0e3943_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_1f12b6289bf4f0d9a11f7aa5aa0e3943_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1912-1-0x0000000000400000-0x000000000040C000-memory.dmp