Overview

overview

7

Static

static

3

2026-09-30...op.exe

windows10-2004-x64

7

2026-09-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 18:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_16c45a26619857c8050d3a662a158ddc_elex_stop.exe
  • Size 21.0MB
  • Sample261001-wx3e8sty8n
  • SHA256 08ea0dea9e9b89d28cfded5cf3077170b480cb3c097aaf6ea3c1a5b421c2ee00
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_16c45a26619857c8050d3a662a158ddc_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_16c45a26619857c8050d3a662a158ddc_elex_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{C302B7DE-AAD4-4806-987B-2FD51AB47E16}\LeaderGuide Pro Plus Version 10 for Office 2010.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-09-30_16c45a26619857c8050d3a662a158ddc_elex_stop.exe"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5524
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2336
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CD7359D1AF2F61E9934D82FB0F9D035E
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1220
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4A5905ED52E8ACFD728948F726451656 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:744
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a011b.rbs
        • Path C:\Config.Msi\e5a011b.rbs
        • Size 62KB
        • SHA256 bba7e4a05388dc6fc235a34839e6dc6da14ae313bcd413133da1cd1e76ec1c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zLGPIconC12.tif
        • Path C:\Program Files (x86)\Great Circle Learning\LeaderGuide Pro\10.0\MASTER\Default Collection\Icon Library\Block Icons\zLGPIconC12.tif
        • Size 213KB
        • SHA256 4b9a6970bdbe2092236d556ab87877bf9442de9b06e7dbd9736f64a0694f1784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0x0409.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\0x0409.ini
        • Size 21KB
        • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LeaderGuide Pro Plus Version 10 for Office 2010.msi
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\LeaderGuide Pro Plus Version 10 for Office 2010.msi
        • Size 20.3MB
        • SHA256 d4af08164bc7e632f7113d287126c7fff504315d37ef9150fd11491a961552e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft .NET Framework 3.5.prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Microsoft .NET Framework 3.5.prq
        • Size 2KB
        • SHA256 e0dba754fa9f04f9b17c9bcaf2558a464b1ce9607cd31c2b080f26163476bb64
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft .NET Framework 4.0 Full (Web Download).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Microsoft .NET Framework 4.0 Full (Web Download).prq
        • Size 3KB
        • SHA256 c80c64c2f08569c9e8ad88470bc7704bb1d3b97c2f17fe81e3e85b9529cd2543
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft VSTO 2010 Runtime.prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Microsoft VSTO 2010 Runtime.prq
        • Size 2KB
        • SHA256 e33147a007bb3b2f7cfe4b598bdcb9b1c423c65b334831cc98846a6da873537a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Imaging Component (x64).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Imaging Component (x64).prq
        • Size 1KB
        • SHA256 48bf0bd3f2288621bffe796a0cfdb2f6c8c513cbaa06a5aae502164abca419d4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Imaging Component (x86).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Imaging Component (x86).prq
        • Size 1KB
        • SHA256 f30ee3c5f50eb8fe2fe29e173fd7b6e08d324d9753d995ed5d21f4e430a3db3f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Installer 3.1 (x86).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Installer 3.1 (x86).prq
        • Size 1KB
        • SHA256 7c452695e76e194d70eeaaf791b5a29354c268918169da3f849d87eebad5f4c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Installer 3.1 for Windows Server 2003 SP1 (IA64).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Installer 3.1 for Windows Server 2003 SP1 (IA64).prq
        • Size 1KB
        • SHA256 7a2c2cd816c6afac6ad13b47635a27f78da75bd1068f4ac95ab2e32dde7338fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq
        • Size 1KB
        • SHA256 47a85d193db5944241442ce40f2f8c1a3bac9fec208de7678d137bb595766301
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq
        • Size 1KB
        • SHA256 f311650d7b3c634af374a997085285bce2464e90a2eb8133c4e7ddc1d0231f6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Windows Installer 3.1 for Windows XP (x64).prq
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\Windows Installer 3.1 for Windows XP (x64).prq
        • Size 1KB
        • SHA256 239d3eb29a16f42865c20219a33b03e59bb9b31cc58a2e47955147518402d824
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\_ISMSIDEL.INI
        • Size 2KB
        • SHA256 12117220d0d30fedceffecea0892b84db0cae5ff685485c0ae76bb0693f2cb7d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{8B108302-95BA-4488-95DA-2E4DC8C87930}\_ISMSIDEL.INI
        • Size 20B
        • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
        • MD5 SHA1 SHA512
        Submit Download

        ~6EFC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~6EFC.tmp
        • Size 6KB
        • SHA256 86d2272ef0933e2271f58519001ff9b13b5df19c3dc81ce54a7cb92116513866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI81F.tmp
        • Path C:\Windows\Installer\MSI81F.tmp
        • Size 197KB
        • SHA256 c0e9d3c5cc95e1d80eacffecaad2460ba430635fb3dda8014461ad3276ea1e96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 26.1MB
        • SHA256 b65efc7ee60bc80e1988418b4d1a93eb263fd9609e0a2b5375b6a4552251c1db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {06ba6de0-6158-4afb-827c-cd4c2014ee1c}_OnDiskSnapshotProp
        • Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{06ba6de0-6158-4afb-827c-cd4c2014ee1c}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 1e7bf8f599fb6d0bd7d5f7898fd1ebc7aaa14f2457c3e18453d11365843de187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download