f1a4f631d70079014c9bfea4eff3579d817aefb952092150cdb35e4c7b13d028

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_a380edde37b89fdb0707fa7ecb1891ce_elex_wannacry.exe
Size 1.2MB
Sample260910-ps5w8stcke
SHA256 f1a4f631d70079014c9bfea4eff3579d817aefb952092150cdb35e4c7b13d028
MD5 a380edde37b89fdb0707fa7ecb1891ce
SHA1 8ab0c811855b255b7faed40464a8bf88e2307aa7
SHA512 2f1f06bf47ab5ce5b95fb5a83d841cd12ec329eae0d0ad91b507fa27da3f6a96b02d6168839c145ac6b09115edae81e15c6c4440bcd9e2410332f52bbb3fb082
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+wqOM:A6F0eMpAAYEhpYhwFM
TLSH
T1D7455C54E683C6F7E92310F0854BE7FBA5309E1580318D2BFBC8FF01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2784	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_a380edde37b89fdb0707fa7ecb1891ce_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	original_temp.exe
2784	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2784	3524	2026-09-10_a380edde37b89fdb0707fa7ecb1891ce_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-10_a380edde37b89fdb0707fa7ecb1891ce_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_a380edde37b89fdb0707fa7ecb1891ce_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX7E32.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7E32.tmp
Size 1.2MB
SHA256 68e288fe264f10dad00d06b450f26e2efdc91b7761a72c79eb733338bec4f7f0
MD5 cf9230ca01caedc9c5403da920f46f9f
SHA1 d9564d5e8a5b00ebfb1929d5d913b9bae23c5f8d
SHA512 b48fb92ed33c229ee8d3c0b531aa1692f303372eda49641affebfa5090034286f34883d502cf8c3820bc135c7bd926c7f2284154ba7915709fe0efed3468e3a4
SSDEEP 24576:j7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVYA+wDG:g6F0eMpAAYEhpVhwa
TLSH
T172455B54E683C6F3E92310F0854BE7FBA5309E15C0318D6BFBC8FE01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 20KB
SHA256 9d770a29c9a6880e374d71a51fa4da176debee2f290182c437bc93bbc56f9327
MD5 a59f686365e8252bd142ae9711412c3f
SHA1 b4a98e5981a4aaf382453ac0d47cbb20585df666
SHA512 5f238c0615aed3102e5447763d52c974435d3168ee9efe82c9b3170a16cdfe2eb45e94867709767a2d8c7a25834be30679435ea72de586ed42548ffeae7ed2f9
SSDEEP 192:oiice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEB:ocvkaG16eSlBY2ZZ
TLSH
T1B492D906EBB948A9E320DE72167B573A4D71F8674A51430F1B66EE8EBC317449C13B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 b2d10f46c6fb3df6c031e997f608e2e5181ad3c0548d397aa8ab7e30c93b48fe
MD5 1d7e546f7ec0d52012d5a62a35b1dbd0
SHA1 cfab43cbfdda6b0af5a59c43a0cc9ed064fec45d
SHA512 dc8a7cd502dd4fa71c6b80638902230ad54501523ae03acb75ad9c5c17baf8907e5fc51fa9decc37f7fde8464be5f5b17fb0926b32ae869a521c490b2935c003
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOyYA+wqO:A6F0eMpAAYEhpYhwF
TLSH
T104455B54E683C6F3E92310F0854BE7FBA5309E1580318D6BFBC8FF01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 6e2b78db26ab58e14cd1c7a6255bc2bd6a40dfefdb3bd6560c915f1b8f97cc6e
MD5 79d49c2cbd9929a6476caa9ee94d08c5
SHA1 bfe6fee811dbfdf1ed1d6f64745eb7e85a6458fd
SHA512 436f269e0695477a667d2ef91b78023c1e4ead6b57ebc3d069d5bab56a8c4a175a36e886799c9cba66063fffa60061d656f0195550f6cdd8c24cf68905db2547
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/YA+wDI:86F0eMpAAYEhpjhwc
TLSH
T116455B54E683C6F3E92310F0854BE7FBA5309E1580318D6BFBC8FF01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 9923a9c33b3b8dc38d72665c04a86d8eeeffb8fe58898fc98e0f293fdc87727b
MD5 928a16f94cf26ce3c8dab21aef8ffb62
SHA1 30cc903144a558a5b45d6aa882232526d32d7f75
SHA512 81f170b12d803eae2d77f1991d41aeda67da844624e41da921acfff763158e771b08eb4014aff27ab1a7ebf08d02f95b886d9ae36548bb0171d7a42c93aa994f
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpYA+wmr:A6F0eMpAAYEhpFhwQ
TLSH
T1F6455C54E683C6F3E92310F0854BE7FBA5309E1580318D6BFBC8FF01BA72D5225A9656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3524-155-0x0000000000400000-0x0000000000535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads