728f00f34d9f3ff3fe9bc8da892bca68f368ed775008151b61274f76add76299

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_86f761aca27e6762897d3aa4e6635c95_elex_wannacry.exe
Size 1.2MB
Sample260826-xenpsshq3s
SHA256 728f00f34d9f3ff3fe9bc8da892bca68f368ed775008151b61274f76add76299
MD5 86f761aca27e6762897d3aa4e6635c95
SHA1 1c825bfee86f58057b86aaf60175729cdb7b794b
SHA512 ed39fe5bb435d2d37352fa1a1756df9f8cf741882427af26d738170855ed4caa5a4849e79a8fc398720c391cae53cd764ec2689d91ef5eece22a47394f63c178
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOE+YYA+wkDu:y6F0eMpAAYEhpH+phwKu
TLSH
T10F456B54E78BACF5E92300F0445BE7FBA5309E2540318D2BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2716	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_86f761aca27e6762897d3aa4e6635c95_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	original_temp.exe
2716	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2716	1656	2026-08-25_86f761aca27e6762897d3aa4e6635c95_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-25_86f761aca27e6762897d3aa4e6635c95_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_86f761aca27e6762897d3aa4e6635c95_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 d2b5712fcd7b91d42939043c8b9c1d6f32cef7f2854802a5feda4bca6cdbba0d
MD5 4e2eca8f267049548370c562e5c83fe8
SHA1 66229dd0b67119de5fd18528ed0866d7f6b280ac
SHA512 0ba9db39a8bcce224d44597a2cac45cf569888d7c8e81fdaca83486af0bd831bbfd10ddf89b3e3d3b1291714d0618bc0e15bdbbda18464635680dd3cc69d5355
SSDEEP 24576:H7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPq1cRs47WXnueVulvspdbl:M6F0eMpAAYEhpCqG37WXnu6ulvKdfLMq
TLSH
T133F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4273.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4273.tmp
Size 1.1MB
SHA256 f1c189b696738ea631b51bcc4eef74ba68861607f8727e05dc9176e1afe1f89a
MD5 ccd409c67913addf21c122fa9da45ab3
SHA1 c3cc3c752d999504fd5c151e14e83971261bb95f
SHA512 febb46595331dc50e54dbb77af23bc4e3508c76b2d87af668a386d76b73759fd0db31ba42902102a6b2fdca7f7c1c5b793af23efcad3a170a5ed162736b76cd5
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOE+YYA+wkD:y6F0eMpAAYEhpH+phwK
TLSH
T138455B54E78BACF5E92300F0445BE7FBA5309E2540318D6BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4554.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4554.tmp
Size 1.1MB
SHA256 bb58fdcc2b75b9ac4f635dfdd0291a686c8b4d80c9fe9fd03fe69e9699920d74
MD5 dd42c0f3731bc191adedf5f6d9c7bda3
SHA1 d90eaf7d7a32d835dac6d8e9b84e583216f263b4
SHA512 4be0a6d03e1142a3f86a675d41354e65079212d7ca14e69db9e2644737a6ffe0ba1ac3aaf6deb23876697b060ab2474d27ae27b27539e3146fe26e01207577bc
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOh+YYA+wk7:+6F0eMpAAYEhpW+phwi
TLSH
T167455B54E78BACF5E92300F0445BE7FBA5309E2540318D6BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-281-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads