e98449f98599c00215c3a9cc09b502e1c2faba3676ed9131790e4e171e4fe61b

General

Target
2026-08-28_095291850e7d3a336e36e1f9088ec140_elex_wannacry.exe
Size 1.2MB
Sample260828-2ndy6stfrd
SHA256 e98449f98599c00215c3a9cc09b502e1c2faba3676ed9131790e4e171e4fe61b
MD5 095291850e7d3a336e36e1f9088ec140
SHA1 c344f61c2717480ba2bee571f49fb3ef0db5a1c2
SHA512 7e32ce3f7feb0935bc5acd2a352c43e893a73868d670136cf95b471c242516e69c88c6bd44d22696ae2db1b57b3a27f5988be182ab796d531f3a4377f4944abc
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+wVYW:G6F0eMpAAYEhpahwiW
TLSH
T14A456C54E743CEF5E92B10F0444BE7FB55329E154C318FA7EAC8FE01BAB2A522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_095291850e7d3a336e36e1f9088ec140_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	original_temp.exe
1672	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1672	3056	2026-08-28_095291850e7d3a336e36e1f9088ec140_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-28_095291850e7d3a336e36e1f9088ec140_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_095291850e7d3a336e36e1f9088ec140_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 8c74ec41843d4586956218667baea7eb1860d2cc9589779d26ea73037f5aca48
MD5 de83e81bfe6fe9cd80d140356be3f2d6
SHA1 77c817d046042b1a12e280cd05c4290aba815d0f
SHA512 b99a4e379119c1bbd9003beb13a589d1cefd360182c2bf73b2dc61912124e4a9cb30f8473229a04405bf3b6ce1025015c4df470e8658c7313b0de24203cd8ed9
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOYYA+wDOnMYenGJiKEbXWtR:+6F0eMpAAYEhpShwiMPnRWt4Y
TLSH
T1D3759E64E783C9F1E92B00F1440BE7BA69359E194C318EE7E7C4EF157A72942367A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDF6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXDF6A.tmp
Size 1.1MB
SHA256 b8a577352256540eaa8889020f74f81da20b1b1859ac4059c68918a6b0a166e9
MD5 8ba4819b162c3b75f6b015e0a23e8cb4
SHA1 edf00c6fc7299d6d1ea61b1b28d9147ac16ddd60
SHA512 c096b42a59d587e2d7bc8cf783cbaa418617a192247603a017bbe844c14a337cbb3e70d81f3c492c0617f4c939a01f86acf28cf8ad1ebaa126ff8fc4996e7fe2
SSDEEP 24576:V7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOzYA+wDW:u6F0eMpAAYEhpfhwq
TLSH
T1FD456C54E743CEF1E92B10F0444BE7FB55329E154C318FA7EAC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 54f6784318a57c452bebe0d0ad2f5955083624cbd37e6659a89617e70ce9776f
MD5 376734c5222d0c0b6d4ce88902f0a144
SHA1 33cc0282e7e4d7ff0fad256638dd37ff781f3d03
SHA512 adfba15b9c6db6f2ef10211ffdae719a2c940e83cd9bc8c5db34680af2ffadb4ecf85f593fb37335586ce192c07ec0b810ed4374b527b1fc1f9c81b01a2afe88
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMYA+wVY:G6F0eMpAAYEhpahwi
TLSH
T1E1456C54E743CEF1E92B10F0444BE7FB55329E154C318FA7EAC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 34fe9c6a6166175ac464a48f23b03a3b5d1644627d507ed175c03b9504f5e274
MD5 14cf104543d712b01c9d06d212ee365f
SHA1 f14ad2a182b29b8f00ed3e94bd55c91cc43d7c3f
SHA512 4a98f191ccb18004a68971b636f7a07ecf327571f7b44c1ad39d25a843b4631cca26deffe1ad203817241cc9ad66171139d25880502659b54024f20f1eac0df8
SSDEEP 24576:t7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+YA+wkq:m6F0eMpAAYEhpMhwT
TLSH
T119456C54E743CEF5E92B10F0444BE7FB55329E154C318FA7EAC8EE01BAB2E522529607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 356b43ab50ee102508fe3b0e8a83de02e358bfd91abbdc0c1012caaa47890911
MD5 b95f479a53c40fdfc9dc917fc077976a
SHA1 6007437a2abe89b03fac70d57e28a3fb8dfdc3bf
SHA512 f2602c4e8bf94cfc0f01bfc555d56b2d9e688780f19ebe50553cbf049c27572965d52665cbc2b52395f93c688962a84a3ef8c3770df1ffe1511d98b68fa2f4c7
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOqYA+wZd:26F0eMpAAYEhpghwD
TLSH
T1ED456C54E743CEF1E92B10F0444BE7FB55329E154C318FA7EAC8EE01BAB2E522529617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3056-152-0x0000000000400000-0x000000000052E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads