13c6c0fbc5dafe74b1f4a53c2cdb5a1e61f2abff04ae59ac9f4c4946bfe5b51a

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_09d798eebc805ab4482f6c89009073c4_elex_wannacry.exe
Size 1.2MB
Sample260910-azp22ashme
SHA256 13c6c0fbc5dafe74b1f4a53c2cdb5a1e61f2abff04ae59ac9f4c4946bfe5b51a
MD5 09d798eebc805ab4482f6c89009073c4
SHA1 5efaf2be67c125008703adf0b1082d5fc53cf026
SHA512 39f48f76d37bcd81967342845254641ec2e26ba27fd2b4660e2411dbbb4574cafc3b8badca403e4d16c060555ec94c31530a3bf354384a08bf0b87b5836e0475
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOwYA+wuVf:P6F0eMpAAYEhp9hhw6f
TLSH
T196456C94EB8384F6ED2315F0404BE7FB96309E1580318D6BF7C8FE15B9B2E523529626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1248	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_09d798eebc805ab4482f6c89009073c4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1248	original_temp.exe
1248	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1248	1860	2026-09-09_09d798eebc805ab4482f6c89009073c4_elex_wannacry.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-09_09d798eebc805ab4482f6c89009073c4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_09d798eebc805ab4482f6c89009073c4_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX75F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX75F5.tmp
Size 1.2MB
SHA256 e9fdab39114ac71e6c4e60996419b825df8be0d8449c9a51c664ca1c63bb586a
MD5 c6fb67565b9d178e67bc6e4199d8675e
SHA1 15ddcff1cbe9445e4cdf2d84b358f1473d8a29c6
SHA512 359ad841955b838fe858e2f50164b4415d72020ea6e6790ec5c2ffcc122d493118028ae94b0bbc1af47b95a864b48e1627461a76947bb04301d9522bd37f5c80
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONwYA+w7t:z6F0eMpAAYEhp+hhw5
TLSH
T151456C94EB8384F6ED2315F0404BE7FB96309E1580318D6BF7C8FE15BAB2D523529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ae69efd1ba53a4d36cc3f2df0782523abfac0c7ecfc938737789a16d5e5b91d3
MD5 627e2dfbc5ab211784e361d2d2509b6b
SHA1 db7d0a4f5f6820117b88fcd553ceaebe4b7c5386
SHA512 3bef1343f1fd191a01e22fac056976c6363cac54d048367fc35717a21c14f68faff3e0562923de27935368af7ca20bc9f2cab9e39b08e42e196fd118e65dc21a
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOwYA+wuV:P6F0eMpAAYEhp9hhw6
TLSH
T15E456C94EB8384F6ED2315F0404BE7FB96309E1580318D6BF7C8FE15BAB2D523529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 fb1cf57b2ba11c13e8f10f641dd225c772798395a03e5459aa78f7871684ec3e
MD5 4dd01f2b63a7b26ea16695bd0a37d526
SHA1 1724d15c42bc5c23aa9fd5667b1c61facf1685c0
SHA512 c257082b677317c044e602e9b74abc98aae8d01213d8b64ea7a5d252f455c5fefd64ec41b93a252e72a92941472095d73c51ab936f587e4053032252331ae91d
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODwYA+wiK:P6F0eMpAAYEhp0hhwF
TLSH
T196456C94EB8384F6ED2315F0404BE7FB96309E1580318D6BF7C8FE15BAB2D523529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 b744bc8d102bf88c407451ebe5108d9f448fba9d4ae772b53a79209f2bcad7db
MD5 9b0a4889fe51f5f94c0f748e4856a14a
SHA1 ef6bf606e9d3efd58e0813e2cfe6c06d76af3677
SHA512 8c67b4cefa48b23b75942a28f7ab498cf52e6ad8608a30ad2e74def238108b15c31746da183fe60f121be9e654a8049795b624330755c140ab5074d994a12352
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8wYA+w7H:b6F0eMpAAYEhpXhhwD
TLSH
T100456D94EB8384F6ED2315F0404BE7FB96309E1580318D6BF6C8FE15BEB2D523529626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-153-0x0000000000400000-0x000000000053E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads