bc2fc39585c6132d76a5589360c16dfdb4440c4d0c42a407ba541eb7cbfb9387

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_2c7775c52cf5a8727f066959ddd9bbe6_elex_remcos_wannacry.exe
Size 50KB
Sample260913-ezb8dstwcs
SHA256 bc2fc39585c6132d76a5589360c16dfdb4440c4d0c42a407ba541eb7cbfb9387
MD5 2c7775c52cf5a8727f066959ddd9bbe6
SHA1 08619936f51c4472e86d35c059c556d8d0ccbc15
SHA512 f0bb468d8c34185c674a6c7b6b6484488780fa5f95fdbe7730d3d63584fe668bd0837ebe5cf86a846f2cb8405a195c4fc5e7a413a0fd90c5a4f1b55d4d12f6e4
SSDEEP 768:hSSkvCfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhT:EmwMmN0MKVCdhT
TLSH
T1C733F656AFD6A4B9F49242F0005E5FFEE57B6461862F8DCAD7908C18093219CFF3612B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3960	Infect.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	Infect.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Infect.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	Infect.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	Infect.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Infect.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	Infect.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	Infect.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	Infect.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_2c7775c52cf5a8727f066959ddd9bbe6_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Infect.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 3960	3120	2026-09-12_2c7775c52cf5a8727f066959ddd9bbe6_elex_remcos_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-09-12_2c7775c52cf5a8727f066959ddd9bbe6_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_2c7775c52cf5a8727f066959ddd9bbe6_elex_remcos_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\Infect.exe
  C:\Users\Admin\AppData\Local\Temp\Infect.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 379KB
SHA256 41c3b6184b14d7816e84ba33d85478fac5ef8cd8b3bfa69fc768fa27fcbacb0d
MD5 ed5f6e4fe334f484937aec8deb026aff
SHA1 8bb9e3f7ca98d17d7f474491dcfa1308200b5e02
SHA512 c1436b7f4021fed8ba6e8e9a6a0c38405f8bcb1eecb59b9742554e60f07f6abcdfee00a8b4482df86fff9e6f38bc087f4cafd02c97afa8dc74f677f3c8e415fd
SSDEEP 6144:cWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjnl5MKVCdU:cAwSfxL/2Dc3jDLLmt0LDQewsAjlX
TLSH
T168847C31FFB4E036D2BB0DB21B2AC716543D79204B661AC3E3E88D9D59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infect.exe

Path C:\Users\Admin\AppData\Local\Temp\Infect.exe
Size 32KB
SHA256 e12adb38d77029c4f25bc1761d6ca12829c89b197ed5e3b88e92ac1f6ff460a5
MD5 15a73468e4038c424afd55b793d4e5b0
SHA1 6378e80e540ecedc1c2007763d9ea7f48992fab4
SHA512 84f3e247c11d5565304829ce7910a7a3b80beed726e4835f033efa6eebf0018276e035490a8e4637b6c6dd4455fa7bb9ca38074f2c17debd656a96cae4930f96
SSDEEP 768:OfDBjTPfbKGFHiUCaYNdGjAIjNgm6WLCdhx:+wMmN0MKVCdhx
TLSH
T117E2C466AFCAE4B9F49142B1001E6FFEB56B50A4C26F9DCB57808C18087125DFF3A15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3120-29-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3120-11-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3120-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3960-19-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-76-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-42-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-10-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-55-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-62-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-67-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-27-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-81-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-86-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-94-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-104-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-111-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

memory/3960-118-0x0000000000400000-0x0000000000401D30-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads