neshta | 3d3308e6d3c901e91861913934233d0000744051a9672a2f0efe06c4dc5d93e4

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
Size 1.2MB
Sample261017-ebtgrswvgv
SHA256 3d3308e6d3c901e91861913934233d0000744051a9672a2f0efe06c4dc5d93e4
MD5 eafd86174932b67eb70b45182ba152b6
SHA1 63ae0cd290137c9ec844141dd91bdb689b436233
SHA512 db70ff079efb70889029f82f297516e64e6af31baac3c1611b75bfad710495110c07b87ed7cb17a34a1892aacd28a00582ffc22a052da1052f332ae8454cca01
SSDEEP 24576:kBEG6o7p9+9uwn+zMYUX9/s8QVtewt86W9/jM9k1VbAaa:XG6oNEmUXO8Qm6uKD
TLSH
T1B54523A674C280B1D9221FB2E75EC770A6397E332621E58F7B237E19F5B42915B32013
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000700000001891e-35.dat	family_neshta
behavioral2/memory/5808-158-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5808-159-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5808-160-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5808-162-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 1 IoCs

pid	Process
3196	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1300	cscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6044	cmd.exe
2864	cmd.exe
1224	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Colors	cscript.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	cscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 3196	5808	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe	90
PID 3196 wrote to memory of 6044	3196	2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe	91
PID 6044 wrote to memory of 1532	6044	cmd.exe	93
PID 6044 wrote to memory of 2864	6044	cmd.exe	94
PID 2864 wrote to memory of 1300	2864	cmd.exe	95
PID 6044 wrote to memory of 1224	6044	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z90C5DC7C\bat2exe.cmd" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\SysWOW64\mode.com
      MODE 120,80
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript //nologo bin\browse.vbs
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript //nologo bin\browse.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies registry class
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /b /OD "C:\Users\Admin\Desktop\New folder\*.bat" "C:\Users\Admin\Desktop\New folder\*.cmd"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-16_eafd86174932b67eb70b45182ba152b6_elex_neshta_ransomhub_wannacry.exe
Size 1.1MB
SHA256 5c33850ef8dc4e91adcd4f3a717d176e4922ac3e7ec9f9a47548c5a946dbcfb2
MD5 a14d01226eefa6d1580858abd07be3e2
SHA1 0f3421071aab678ac2da6edc75342aadbe7c1660
SHA512 d255e9fd3522128c1b948023c8ad72c156629095b7c378cbe34490645da896cad31870ed28148f84568113ba24c147abb02ec582fe9d35cc1687ff049691b3da
SSDEEP 24576:gabBEG6o7p9+9uwn+zMYUX9/s8QVtewt86W9/jM9k1Vbp:gZG6oNEmUXO8Qm6u7
TLSH
T1494523A635C28091EA125BB3F39ECB70A6387E771621E58F3B13BE16B5F45514B32113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bat2exe.cmd

Path C:\Users\Admin\AppData\Local\Temp\7z90C5DC7C\bat2exe.cmd
Size 9KB
SHA256 1fa3bdad58d2a811aabdf7e066acf1c763af3cd0679d0d13de5f82d486e26b25
MD5 032990e374fae57ee7b9d6d466748501
SHA1 702587a178e94b761b3315046f4ef95a1142e947
SHA512 98928ff6a3cf12f01d53a1b3652bbf7837136590b068b9602a8401ae7a61deff8f38e73b7f24fdaca741b2c2add16f8e3b99870744e98c97ea4b8d13fb824358
SSDEEP 192:p/wJ8KrheUfm2n4+wEgYvxyu1nub73x0wU20/RG:p/+deCm093gYvcQGDiX20/RG
TLSH
T15822D95372D165AA53E30F57397855EAFA29E0DF1E830CAA749F843863082DC34BC5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browse.vbs

Path C:\Users\Admin\AppData\Local\Temp\7z90C5DC7C\bin\browse.vbs
Size 928B
SHA256 cbaf396ff11d723e0fff497c6b7afedabe6975bcb32b7512058732911111ab15
MD5 8580d8cab38506f200f4d935edcc19be
SHA1 02866d139fd8addedaef72521e245f713c5187b4
SHA512 6875831af53a0dd9de1de23fd30703fc851f129078699cb0b2331c41d2fd66a98fe0eb09cff208890563bc627533b8de793bb06e44746588109d0156857887a1
TLSH
T14A11C80B606A05338AFFCFA394129E8DF6E4121B2131005DBA0CCCAD2F35EEC596106F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5808-158-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5808-159-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5808-160-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5808-162-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads