8613ee594c165077000a0ed83028ba3770f665de913739e4d48072fe4be647d8

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-04_ea5619554931e58810d1fe29f619cd10_coinminer_elex_wannacry.exe
Size 2.0MB
Sample261004-213s3asy4j
SHA256 8613ee594c165077000a0ed83028ba3770f665de913739e4d48072fe4be647d8
MD5 ea5619554931e58810d1fe29f619cd10
SHA1 48130a9e2f27100cf8a40d4478f33c82772db981
SHA512 c23c6e2cfca8a5085b79393d2d99eae7ef0b8d003d080b1b2bad3d7f100c2ac5e36e0a4e99fc7f65dc6108e0630978a4af588df81200985a7303d8c81f8bd7eb
SSDEEP 49152:kfp/dnUQ5ZAoVufaAGa2jFtv5kRC7TgWQVREjwd:kfp6Q5ZAoVufgeR862m
TLSH
T1C4A533647CE795BEC0E14332C988957926FFCEA19817C00B7F9476867E35C21832D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	zar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	zar.exe

Executes dropped EXE 3 IoCs

pid	Process
1192	zar_load.exe
2992	zar.exe
3508	zar.exe

Loads dropped DLL 1 IoCs

pid	Process
3508	zar.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97
PID 2992 set thread context of 3508	2992	zar.exe	97

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	zar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zar_load.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-04_ea5619554931e58810d1fe29f619cd10_coinminer_elex_wannacry.exe

Modifies registry class 58 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	zar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\kplfL	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\ybuwLXPB\ = "tCZL~FY@}tDGYhlfQzCFyoBP"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\wspoTgjmJjXxW\ = "Ds@LonSn~PHbX^WRc_Y\\_"	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	zar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\EnableShareDenyNone = "1"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\plmoZ\ = "M]ARD`tR][D@qg{TDx@PmWvXc"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\FppvmNs\ = "ThSijqj]I_cJagYiI\\`hn\x7f]pnlJ"	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	zar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\ManualSafeSave = "1"	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\InprocServer32	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\pjraWvtjnLwo\ = "^plWO^ody}PgDEu{O\\]_"	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\mnjSjvJnnj	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\ = "Microsoft PowerPoint Metadata Handler"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\InprocServer32\ = "C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Office16\\msoshext.dll"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\InprocServer32\ThreadingModel = "Apartment"	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\pjraWvtjnLwo	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\FppvmNs	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\rkiOqonoacyf	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	zar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\NoOpLock = "1"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\mnjSjvJnnj\ = "uTpn`zXFW]x_jxRxZX"	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\wspoTgjmJjXxW	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\mnjSjvJnnj\ = "uT`n`zXFW]h_jxRxZX"	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\rIXyqjZmE	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\rkiOqonoacyf\ = "xtw{NXtmyHC~BcukGlFDLP"	zar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\plmoZ	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\ybuwLXPB	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\kplfL\ = "gKB\\GqMuicNXdrUC^rzumlS{p``"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\rIXyqjZmE\ = "`b_aMPnZhqgVgpT{FnDId]fQ"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\UGlH\ = "zzYxhZoKqhS^ChiQ~mFwbiTwtVADXF"	zar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\rkiOqonoacyf\ = "xtw{NXtmyHO~BcukJy`{fp"	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	zar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98E16880-216C-3601-216C-3601216C3601}\UGlH	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	zar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	zar.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	zar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	zar.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2724	reg.exe
2584	reg.exe
5536	reg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3508	zar.exe
Token: SeIncBasePriorityPrivilege	3508	zar.exe
Token: 33	3508	zar.exe
Token: SeIncBasePriorityPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe
Token: SeDebugPrivilege	3508	zar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3508	zar.exe
3508	zar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1192	3336	2026-10-04_ea5619554931e58810d1fe29f619cd10_coinminer_elex_wannacry.exe	89
PID 1192 wrote to memory of 5660	1192	zar_load.exe	90
PID 5660 wrote to memory of 4624	5660	cmd.exe	92
PID 5660 wrote to memory of 2724	5660	cmd.exe	93
PID 5660 wrote to memory of 2584	5660	cmd.exe	94
PID 5660 wrote to memory of 5536	5660	cmd.exe	95
PID 5660 wrote to memory of 2992	5660	cmd.exe	96
PID 2992 wrote to memory of 3508	2992	zar.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-10-04_ea5619554931e58810d1fe29f619cd10_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_ea5619554931e58810d1fe29f619cd10_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\ZAR80\zar_load.exe
  "C:\Users\Admin\AppData\Local\Temp\ZAR80\zar_load.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240722203.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\SysWOW64\reg.exe
      REG EXPORT "HKLM\SOFTWARE\Licenses" zar_reg_old.reg
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Licenses /f /v {K7C0DB872A3F777C0} /t REG_BINARY /d 6d9126132a0b1ff09ca7128fb7ec2df108f6962684b5e9fe89f607ffffffffed2a296a736167a8ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000fe89f6072a0b1ff09ca7128fb7ec2df108f6962684b5e9fe89f607ffffffffed2a296a736167a8ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000fe89f60700002a0b06ffffffff
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2724
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Licenses /f /v {I0D92C317D221A39C} /t REG_BINARY /d 34000000
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2584
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Licenses /f /v {00D92C317D221A39C} /t REG_BINARY /d 5b3e860fef81a3b4713661aa0b837a93e90aa751ed8137e79fcaa0ab182023e8dd6351587339000bd9f1ceb2c1e7dc28cb86657f0031f642dc1d458b8122a73b2df22f7f15b3d12fa41f13ae5456768d3f09eba9e1ba48d58b7997392e97404344ace8c014085d9f26f18a6f08a8ca77ea079ec37062a8e43282e635b8cef8e582674fd63031cac154c2bb9702e03fc8c342eadb2a98d55202c71b9af55bdc477781a8344e70207acc84264ac083b841f2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\ZAR80\zar.exe
      zar.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\ZAR80\zar.exe
        
        zar.exe
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Direct Volume Access: Opens a physical disk for reading
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240722203.bat

Path C:\Users\Admin\AppData\Local\Temp\240722203.bat
Size 1KB
SHA256 f9997bba628f790ac736b22f0792043b70070d70de800b61102ccb9aafb6c2a5
MD5 5537d9612c77c81a7182af9852a5488a
SHA1 2eff07ec4d3ba8f790efa9fbde41397b333a3ff7
SHA512 b609d80917d9efaa244b0c59215ea4b52389e37a23575f2936624f7bab4591a3a36b79f3f0b1da981973022b3b11ca826959022293fe2357406a9bb48a7803fa
TLSH
T19221ED8064E1421AAB0BE171FD8EE72BC768F1A125C6218C12E6F370027648726BC1E8
MD5 SHA1 SHA512 TLSH

Submit Download

zar logfile.txt

Path C:\Users\Admin\AppData\Local\Temp\ZAR80\zar logfile.txt
Size 134B
SHA256 47b615488f009e30b180f0fc0189702e1de8cef1ffcdb93eb796f120c7a83ce9
MD5 6ad11a0184fff70b466c0c71b40cf2a7
SHA1 758d719971bb8e57d6ac9b5ef2fb19b0f29d12a8
SHA512 9e31330d6eba1ca63e7dae40c815903a5dc9cf704bd78da674c6763b12c278a0afe251f02b52594c4488525fba1aad222e17657dcf46a32b30d194ca394b1a58
TLSH
T11AC04C5AC5A690B70A5E0802F713B31163E17902DD93546508FDB741594C963C2210C3
MD5 SHA1 SHA512 TLSH

Submit Download

zar.exe

Path C:\Users\Admin\AppData\Local\Temp\ZAR80\zar.exe
Size 1.4MB
SHA256 2decca9d03a54e9b0bdc06c385585da6939ac690d1af2d1050ee07b3d125fb71
MD5 70ff664eafddd55b219ba65ddc38e7ba
SHA1 1a80ecccef5857fba5787f0cd7599525134f9070
SHA512 cb0f8a99dcba23c318e74aeafba5147062927796862b319cd6f7b2bc5da17c1acca540b3792a94191cea3b67f90cf03101618dcf9df77ba3b22b87c91ed440c1
SSDEEP 24576:RtKPeNo/AGqT+OziGRW31OggJhB4Sn7TgUSw0gYXbeHuIrdmOSrDAME3v:HKPesQH2UWlOLHLjS/Xbku8FSv7C
TLSH
T1DF65E035C282C42EE0B656FED6B37B2D8EEC7F91532412DB36D02DCE5630945DA6620B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zar.lng

Path C:\Users\Admin\AppData\Local\Temp\ZAR80\zar.lng
Size 153KB
SHA256 a92a9f06c4ed2168181d1ad69f5108ec8c4f051c3b6841f34824c73c9dad86fd
MD5 0daa416109f2cc2633a11a70c77d2f36
SHA1 36d5472e2c71047a8586602157c77fa4dc709fb7
SHA512 7b77bad2eb2e88620e97cbe7985d1f03a52257c2bd674a50edfb3c6bd91036b603b26deec6324ce097a5969fe5b7bda9090eb803aa971ac43d418475033c72db
SSDEEP 3072:LQyUE1oxrMEr1cxIw45UOqkKhD28e7QJkwxaAg5YC5GFyB9Szw44DIWYXUCSdFHo:ywzhYeCUwru
TLSH
T17AF3C10777FA4108B2F6AB906A3604B1C7B6BA851A3CCD8C01DA245D19FDE609D71FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zar_load.exe

Path C:\Users\Admin\AppData\Local\Temp\ZAR80\zar_load.exe
Size 9KB
SHA256 e8e087ea55bedc610ab74eb67f711b1fb49bb39c6e190c1620d45f51ddd10271
MD5 921d1160078c5e60ac1cad4cf836a6ce
SHA1 9ea0fd145d7133568ac3de4887dc6d6dfe28608e
SHA512 67ddaf2c1ce705439a3d6bf784a7f29835f02aaa1b9089da8a5007a776b99ec485d89959541a8bafc8eb32d75d64318e42fcf450e257ea168ad12864cbdd3391
SSDEEP 192:J0H0G6wUqG9cyV7SM4o4feeEEZpaHiho4:JqxjUqG9T7TweUpGk
TLSH
T1C512F94A2D1A45B1CC08C170788B1A2359EECD366F842E5FD70998B67EB415687B3F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\ZAR80\zlib1.dll
Size 54KB
SHA256 8aaf9e851021d1afab9e2b93c9e796d37dd31c114a76476e6c00bd8931ee9446
MD5 3ecfe1baeab591769664567c4e653e6f
SHA1 1523ae71ca322671022b297e19c8acabe9f2105d
SHA512 f52e5156b7a179f523a6b7e43b88e73271dac18f5f21dfad8caddfa199471e41d25772c2d7b6ab4e34234d338e7fd72ebe8ad70946fc6126f1a81c9d085832e6
SSDEEP 1536:T2zJ1f1Q4HroGEXRKQ6CthnToIfnIOrIOnXK:qPlHrARKQ6YTBfJdnXK
TLSH
T1D0436D1287D997E6E8B8153A54DF931ECB32B10547AEC6C7684C1BA568133E5A7303CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2992-66-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/2992-28-0x00000000005CD000-0x00000000005CE000-memory.dmp

Download

memory/2992-27-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/2992-57-0x00000000005CD000-0x00000000005CE000-memory.dmp

Download

memory/3508-60-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-62-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-42-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-41-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-31-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-56-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3508-32-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3508-58-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-59-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-37-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-61-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-43-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3508-63-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-65-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-38-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-67-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-68-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-69-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-70-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-71-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-72-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-73-0x0000000000400000-0x0000000000722000-memory.dmp

Download

memory/3508-74-0x0000000000400000-0x0000000000722000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads