05e678377ad87d1ac3fb89550cd19cca2d61d4968d13a227cf47995e36950175

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_f84901e273b9e8084c44bf9ba3e7f476_coinminer_elex_hijackloader_mimic_pay2key_wannacry.exe
Size 218KB
Sample260922-tp31paydkf
SHA256 05e678377ad87d1ac3fb89550cd19cca2d61d4968d13a227cf47995e36950175
MD5 f84901e273b9e8084c44bf9ba3e7f476
SHA1 c8a7cc484833836ebbbf45d342df781b819db89f
SHA512 ea602ffc3be74a3522a2ba6d222bfa3338aa214084bb16bffc621cc4497e943a7d29bf0d76876659d6770417ef7234aad59d06828db92d4f9e0858167dfefcf6
SSDEEP 6144:dLTHQOrRezFWuRwICnJtt3dJpMER8LfDB83H:dXwOrReFWQ6DdU17Dq
TLSH
T16624E1027BC1C8F8E1A21571498577A66DB9F7340B258AC3A7C40E0A5BB13D5EB3E3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-09-22_f84901e273b9e8084c44bf9ba3e7f476_coinminer_elex_hijackloader_mimic_pay2key_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-22_f84901e273b9e8084c44bf9ba3e7f476_coinminer_elex_hijackloader_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4124	4468	2026-09-22_f84901e273b9e8084c44bf9ba3e7f476_coinminer_elex_hijackloader_mimic_pay2key_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-22_f84901e273b9e8084c44bf9ba3e7f476_coinminer_elex_hijackloader_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_f84901e273b9e8084c44bf9ba3e7f476_coinminer_elex_hijackloader_mimic_pay2key_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 360B
SHA256 c6e57a64b82e57b00c3919b1971494ebc097c462fb55038a9ef7df40595b9b2c
MD5 b6c277158761a8aa2318656acb5c018f
SHA1 21ce3578bd3a08c49d0ce0a3e5ac401106aa1fd0
SHA512 179f4abce6f858264fd62128fdb5e632290b4efa2f72e1b734a35e1a22c6a763b9be3324a646c0b7bded83107cd349b807eadccdbdf409b0b4148f3a71514f65
TLSH
T1A6E0D801C0B9F766108D902BD5F2BE5EC194B71A2D2F6316BB2288CEA9D0C5DF591243
MD5 SHA1 SHA512 TLSH

Submit Download