3cb01968dcff829022109c11e957d117e8ab5112011432191c4e5f271b45a11d

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_109078d264a2492d78d9f005fc4e3668_elex_wannacry.exe
Size 1.2MB
Sample260909-hst2eashnb
SHA256 3cb01968dcff829022109c11e957d117e8ab5112011432191c4e5f271b45a11d
MD5 109078d264a2492d78d9f005fc4e3668
SHA1 a3716f796ba24de1eceef3817fcdeadbe4981719
SHA512 e96c8a1a18465c267f3121e7cc0d344d059c585a232391f4a7961a45c72a76a9502497b1edd27916697affadb1f8011ea8e2d2cf62919e8e7b9d97448976d1cc
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOp+YYA+wK5Q:y6F0eMpAAYEhpW+phwOQ
TLSH
T138455B54E78BACF5E92300F0445BE7FBA5309E2540318D6BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4736	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_109078d264a2492d78d9f005fc4e3668_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4736	original_temp.exe
4736	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4736	3664	2026-09-07_109078d264a2492d78d9f005fc4e3668_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-07_109078d264a2492d78d9f005fc4e3668_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_109078d264a2492d78d9f005fc4e3668_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 f1dd83cad054742eacb7e4dc2f760ef92795056226799d06786511fc89ac1331
MD5 6d6b46aae6546f0d31b9cbd3d71f6eca
SHA1 61d2ce2f0b36294f2a635b7132e07100dde5e84e
SHA512 bd55b7f516e6b55b357480a16db9b615318c6b882f0b3dd94bc2dcdf34a5a2f2d5bc4932d599b126965dc065d80d4fc8c6fee4f4269540992bb408a888d979a2
SSDEEP 393216:dylw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vX3:duWO1c877xqpyovvVWJ6VFK+q3cSvX3
TLSH
T1F45712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5BB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5BB6.tmp
Size 1.1MB
SHA256 8962577c42a2ba1abfeb38985882bc92bb7061292e15bfa60c629b81c072b937
MD5 ce02c0a46976dc08bcf1bc75c1d987fa
SHA1 5fc38df2c69116ea4d3b9988b082ea8e017812bd
SHA512 cafe4e82a379bcebbaf63ea35fff0f8f8331d53d07424cba89a0394cf5019125b1f8e785847d1a3541d836049afcc2965e52a893684c466aaa6e67d90b5c24f5
SSDEEP 24576:57VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO5+YYA+wjU:K6F0eMpAAYEhpe+phwY
TLSH
T1D4455B54E78BACF5E92300F0445BE7FBA5309E2540318D6BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4292e647f9d70fd788ffdf267606c29b8b954be62a31eeb23cb04c0dad4f387e
MD5 6cb50e529b2abee03249d5b4de718562
SHA1 54444cc5a6c10ab93736e046f18c8b3b51557060
SHA512 3092f1f533917455f9e658a7551317e42f9d8c4dff53a8315fc23d2ae7c1f7699f447a5cf94866422b19966087649fe60cb1c12d64189d9de4bf0823a3d78cab
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOp+YYA+wK5:y6F0eMpAAYEhpW+phwO
TLSH
T1DC455B54E78BACF5E92300F0445BE7FBA5309E2540318D6BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 c99319e5ba114b3fd22a4fde98cb1b8cb068377dbdecb1440f10bce8cf02a3db
MD5 7cc4fea57e62ac252031e4f9824bbe27
SHA1 be9d92aa7c9e936b4afc9712a024407901bb99d9
SHA512 69f3909836ff6c503462a622cf7e51f6efff907575af0129e2d2ee7b9c9534aeada17c49b8330abf2df1e8de73658e96d33d6e4df799609d0f76794c126ba7ed
SSDEEP 24576:J7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOm+YYA+wjM:66F0eMpAAYEhpF+phww
TLSH
T1C4455B54E78BACF5E92300F0445BE7FBA5309E2540318D6BFBC8EE01BAB2D537529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3664-151-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads