Analysis
- max time kernel
149s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 01:32
General
- Target 2026-10-13_f1cd9fc82580bca3988f52d3259bfa64_coinminer_elex_wannacry.exe
- Size 7.8MB
- Sample261014-bye14sd18y
- SHA256 cfebf31d7ee7246863c316f7981f4c136821e98b91c7da425cef6471d1d0b826
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 4 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 64 IoCs
- Runs .reg file with regedit 2 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_f1cd9fc82580bca3988f52d3259bfa64_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_f1cd9fc82580bca3988f52d3259bfa64_coinminer_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinRAR 7.01.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinRAR 7.01.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1P83O.tmp\WinRAR 7.01.tmp"C:\Users\Admin\AppData\Local\Temp\is-1P83O.tmp\WinRAR 7.01.tmp" /SL5="$801CE,7631165,67072,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinRAR 7.01.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I15FV.tmp\_isetup\_setup64.tmphelper 105 0x4604⤵
- Executes dropped EXE
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\settings.reg"4⤵
- Runs .reg file with regedit
-
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /clean4⤵
- Executes dropped EXE
-
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup /S4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Program Files\WinRAR\Uninstall.reg"4⤵
- Runs .reg file with regedit
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
Rar.txt
RarExt.dll
RarExt32.dll
RarExtInstaller.exe
RarExtPackage.msix
is-CRV7R.tmp
is-6CV86.tmp
is-E72PS.tmp
is-MJIUJ.tmp
Wizard.bmp
is-CH5A5.tmp
is-IV4RH.tmp
is-936OF.tmp
Uninstall.exe
Uninstall.reg
WhatsNew.txt
WinRAR.chm
WinRAR.exe
rarlng.dll
unins000.exe
Uninstall.lnk
WinRAR.lnk
WinRAR 7.01.exe
WinRAR 7.01.tmp
ISTask.dll
VclStylesInno.dll
_setup64.tmp
memory/3824-83-0x0000000008360000-0x0000000008361000-memory.dmp
memory/3824-42-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-69-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-67-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-92-0x0000000008390000-0x0000000008391000-memory.dmp
memory/3824-66-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-64-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-63-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-60-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-87-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-68-0x0000000008310000-0x0000000008311000-memory.dmp
memory/3824-65-0x0000000008300000-0x0000000008301000-memory.dmp
memory/3824-58-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-57-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-62-0x00000000082F0000-0x00000000082F1000-memory.dmp
memory/3824-55-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-54-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-51-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-49-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-48-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-61-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-59-0x00000000082E0000-0x00000000082E1000-memory.dmp
memory/3824-86-0x0000000008370000-0x0000000008371000-memory.dmp
memory/3824-72-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-80-0x0000000008350000-0x0000000008351000-memory.dmp
memory/3824-77-0x0000000008340000-0x0000000008341000-memory.dmp
memory/3824-74-0x0000000008330000-0x0000000008331000-memory.dmp
memory/3824-71-0x0000000008320000-0x0000000008321000-memory.dmp
memory/3824-45-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-43-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-40-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-39-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-37-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-36-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-47-0x00000000082A0000-0x00000000082A1000-memory.dmp
memory/3824-46-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-56-0x00000000082D0000-0x00000000082D1000-memory.dmp
memory/3824-70-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-53-0x00000000082C0000-0x00000000082C1000-memory.dmp
memory/3824-38-0x0000000008270000-0x0000000008271000-memory.dmp
memory/3824-35-0x0000000008260000-0x0000000008261000-memory.dmp
memory/3824-41-0x0000000008280000-0x0000000008281000-memory.dmp
memory/3824-98-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-99-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-100-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-101-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-102-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-103-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-104-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-73-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-75-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-76-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-78-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-79-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-81-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-82-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-84-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-85-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-97-0x0000000007F8E000-0x0000000007F8F000-memory.dmp
memory/3824-88-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-90-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-93-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-94-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-16-0x0000000002300000-0x0000000002301000-memory.dmp
memory/3824-963-0x0000000002300000-0x0000000002301000-memory.dmp
memory/3824-91-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-89-0x0000000008380000-0x0000000008381000-memory.dmp
memory/3824-52-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3824-50-0x00000000082B0000-0x00000000082B1000-memory.dmp
memory/3824-44-0x0000000008290000-0x0000000008291000-memory.dmp
memory/3824-33-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3824-27-0x0000000007BD0000-0x0000000007BE6000-memory.dmp
memory/4608-962-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4608-9-0x0000000000400000-0x0000000000417000-memory.dmp