3422615c3cf8bfea38fea7538bb068295e29d2a57357cc5c17c083fe999526b7

General

Target
2026-08-28_75f5b76f4e3b99abeef0031ae6432959_elex_wannacry.exe
Size 1.1MB
Sample260828-rfntasyfjf
SHA256 3422615c3cf8bfea38fea7538bb068295e29d2a57357cc5c17c083fe999526b7
MD5 75f5b76f4e3b99abeef0031ae6432959
SHA1 ffe6e8e53f08b27b0e1bc3f021bb9609680ff2db
SHA512 004e9e404da54d28f8cf25a4c0818e58bd70f10d07f122957a7ae549dd1a8d2c3e9456313b2071460be220f423484b4a8056d6e381ac8bf8154bbc6371f539a8
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOvwA+wclt:r6F0eMpAAYEhpewhwst
TLSH
T102456D94E78394F5ED2315F1044BEBFBA5309E194032CD7BFB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4444	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_75f5b76f4e3b99abeef0031ae6432959_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4444	original_temp.exe
4444	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4444	3052	2026-08-28_75f5b76f4e3b99abeef0031ae6432959_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-28_75f5b76f4e3b99abeef0031ae6432959_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_75f5b76f4e3b99abeef0031ae6432959_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.5MB
SHA256 f6dac42e29141be7eed5645b5c5c061dad35a985b1079df97faf9c15fd352cf8
MD5 7ef6d519c7da9838cd649e48ae74c52e
SHA1 c068aefbbe9d726ef9f9daefe80658781e0a82ca
SHA512 202175464747298d59dd9861c6594069ff9963d547c6c693fee700a1acb57f5b9c00384fe09802612ae5eb548ad429c9c14c0d3809c8b137231bdfd61d18228e
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOwA+wCTnMYenGJiKEbXWtU:76F0eMpAAYEhpDwhwUMPnRWt4J
TLSH
T1E9759F64E78394F1ED3300F1444BE7BA6A349A194431CD77EB88EF14BEB2D52767A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3E57.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3E57.tmp
Size 1.1MB
SHA256 5cf009b64d423c8d9ff945f96902c514179b85c4897e527e67fa88441c6d5f7a
MD5 90c526c969d896571cd645d18b149f1e
SHA1 483600f1ce1c71874daa989942e941f4c67592d1
SHA512 fbf6936fdddf785a00e080ddc8f89c2e7ebd5f57e4c7444df378bcb1fb8d3f01b7dd2e5ca0067d3aea0e754fe43fb4c3f284b0d0c1f59a9a248a41ed490e1417
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOWwA+wC7:b6F0eMpAAYEhp7whwc
TLSH
T1DE356C94E78394F5ED2315F1044BEBFBA5309E194032CD77FB88EE10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 0ae278d21870728bbe66f1e8802699d546a3e5dcae36da99cf0a123ab4cb58ad
MD5 1a03b9db6604d6737173431ddd38eb62
SHA1 5d10bf8ee7a2008712a445476fa75829c526651d
SHA512 5d63cdb6663771548423804e33ccef150aacb00ee3cc77e93574e1bfedd4bcb683dffd8ef00691e3db367b2f15539841a2469f2bd8b83bb647f35b10fa437313
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOvwA+wcl:r6F0eMpAAYEhpewhws
TLSH
T18E356C94E78394F5ED2315F1044BEBFBA5309E194032CD77FB88EE10BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 e893a177dc3c097bf7e72f19164c8abbfcb714de049cfda45ccdd5a0a197d6bd
MD5 4456439b2640a3f083ed87706103c2f6
SHA1 6108f86e0a3e53f2e3f827c549e0f78cfc96edd9
SHA512 f846ee53829186b6b75176a99b50aa83c1df62bbdad41eced5d2fbd908cdda176f0333400a7b80733940b0efd4eccc33b4ba4f7c1d7b6cec3abe204f8aa647a4
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOPwA+w42:r6F0eMpAAYEhp2whwD
TLSH
T161356C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 bcdfdb9725c1d545b60724a1ef3bd73fa6394b6c240b5b9ef06037b016967c6c
MD5 a99e251d5d47ff37ec1d3def6ceadfbb
SHA1 3cddc9a59d117399da1613eb2767dbfa755fe803
SHA512 1cfa00c0a2501222c6c7d265964e159e10ef6c87c97725602010242068b5bb47376ae7df251d55e92aa6eeeae8dfa772aebc7389452f0698dc0eb3d9f2677199
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOFwA+w+Z:T6F0eMpAAYEhpQwhwG
TLSH
T183456C94E78394F5ED2315F1044BEBFBA5309E294032CD77FB88EE10BAB2D523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3052-155-0x0000000000400000-0x0000000000528000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads