Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 02:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe
- Size 11.4MB
- Sample261024-ckheraea65
- SHA256 2f79bbb98234656faab1310f685cf39521e5d48e37c231dd6db9c4982a0b10a5
- MD5 a3e8d2780ab865de359041966f2674e1
- SHA1 e93c90c7c51956e7062541abf3ba235a8b1a6d95
- SHA512 fc513f3e7dff9e994136d42b98ba3d51f445b16b719f26d5a53ac45ea62ce062df412ef2d5897d363cea40b440946ae13ca5f8b482f5eb56ddb6550cb79c6309
- SSDEEP 196608:15aF+3CoFGoYt2Hys68rSHeDqbdxlQOoSAOmantbVZFAz9ON/y5S8e:15awCQrYtS68ZDUo1OVntbVZFAzq
- TLSH T101C633063F6FB4F9E29644F48541FBA946EDE4B44BC8969389C1AA056E331C9F13D0CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral1/files/0x000700000002450f-81.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe - Executes dropped EXE 2 IoCs
pid Process 2192 RevoUPPort.exe 2064 RevoUnPro.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico RevoUnPro.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RevoUPPort.exe - Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe 2064 RevoUnPro.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1440 wrote to memory of 2192 1440 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe 85 PID 2192 wrote to memory of 2064 2192 RevoUPPort.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\RevoUPPort.exe"C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\RevoUPPort.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\RevoUnPro.exe"C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\RevoUnPro.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\Data\KEVINULC_Admin_747854149-4118156852-591593384-1000\RUPBackUpData.ini
- Size 166B
- SHA256 9269ab912708edfed0a1a67585e355e5f01e461d34704d221c1b85c4fedf76ef
- MD5 37f82bce620363376891d5e279fee17a
- SHA1 d3ba83da02621bba0c6a265ba92d174c009d73aa
- SHA512 0d99bc3c3ded414310db71fc7d4bb986e77f15286a62b1fb2d8d758f15dc808ae97a25cb147293d069f3b58ca18ef33bc031ca5f0f74494752ec652f7272a91c
- TLSH T1A8C0486787FA0565F4F76F24DAB802B24BB03C08783AE08D01E0021E89F168090A27B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\Data\KEVINULC_Admin_747854149-4118156852-591593384-1000\RUPHistoryData.ini
- Size 144B
- SHA256 671e39f684ab5454a383b9a6804128f599b298ef197253440ef33942dc3de953
- MD5 b772c396e2ba81c75aacb486633b4f82
- SHA1 7fa0275d243ff34ce55a0c351bb3556679523f3e
- SHA512 c63ee4aa6a8ed2c1b5dc9bcb0da41cdaa7ec17b4590f9812b0c0df0fbb974e23be0a15e9e50bf71ac70068abe6304d7e0ba67aa54c83f372b2837cbe55f48c37
- TLSH T151C0926793FD40A8F4F32714ED3805B30B75BC04267AD08C00D4021D08F024480A23B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\RevoUPPort.exe
- Size 172KB
- SHA256 ec8070594d12fd76aaf18476488e3f24ecdb08830d26004ef6b90e41abda6fd9
- MD5 984f51ec99705062fe068dc4bef3fbbc
- SHA1 2a617dfdee0d0bdf76556a2d0a3bd1f27e9038a5
- SHA512 68e029bd81a147df137cc0d8abca472b826856fcbab5470fbe9fe63d866a3fffe6f1002d10c0a1cdf31b275dee5b5ed188d750325eb99f05848d953bd28f7edb
- SSDEEP 3072:QZS1ODHhmmm/DiLgweak5yJcDK5io5RljzolzXZSx09FeR:QS1pU4qjzoVkx2s
- TLSH T1FA04AE43B9C098B0D8360E302460D9A5A93FBE115F658DBB7754632F6F34181AE39F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\allp_report.dat
- Size 1KB
- SHA256 f74fbf45b1e400572b068a7ca4e66d8a21abc3a22e901f3f2a1f6dccf680beae
- MD5 2a8a6ba4ac1ad6ccdbd5eb8f9b66943a
- SHA1 9cabe7afa81a9d52c2ce41b3d655cf55530cb21f
- SHA512 cfc4648abe509da7dcd9a2305b84452130bcf43bb3e8c03c26396111701d699680aa60285e773a3818bcfe0f54cbe39358770bae9da5fa0fcd86fc7ad06b915b
- TLSH T148311FAA77FF56C4F0F74F33D51A5A2156B9BCF83930A1A9734B02AD44B258848A0733
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\ctrlbars.dat
- Size 638B
- SHA256 be791752cf43ef1d366770c2473eccfa9cebdaa09bf3c8afc03e7dc70f1896a8
- MD5 95973429f111cd497ab6e33aed33c4b5
- SHA1 7adbf116c5df9fe663cb94da1c68f048e4bd3d91
- SHA512 24d4051c3d7427bfa978588a27305ba5ec9accd22452f5d5bb9601ed8e1b262fe8f6de0a79da76ffd44ed864df088c9c148bf89a31a60a5eb7e1db6b841838df
- TLSH T127F06527F760C201D8108231189D9BE65295FC109E754B43B013B34D0EB1140CCC5E4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\lang\english.ini
- Size 123KB
- SHA256 f0f1890de8a60f87297d6de21146977060a3b5d82e09523bced0c238e94f5d2e
- MD5 00d7babcb1fca39669a305acc4e6bc4e
- SHA1 caa71de90128acf6e8d812e02aa8ba4622bf8454
- SHA512 9f1348f6ee7325b7d3381865bda4d71807da45c941c3b40c7671df04a6558832dfd03f25f5664250b43b641117d7d3d7c71f7e81b747cbc559fc5b8169033f66
- SSDEEP 1536:yG6KyyErUp+ihmoqVl4hi7bFwlBB9YK3zZ1lvE:yGXy3rVCmoqVlcilyB0KjO
- TLSH T1E5C3AC5267F80119F6F77F54AEB506714E77BC9AAD38D64C0280058E2AF1E40E8B277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\license.dat
- Size 368B
- SHA256 cc933f5b096ac5868e35b4a083cf4731094fe09458696d5277fbd924009a8507
- MD5 ecf5774bcb2d29d042f7a752fcd0df2d
- SHA1 ec957331a29d5fe8d927ff0ed6ad2144ab390a5e
- SHA512 a08c0d6b7af7eeb19ddb96ed8fdfbbed75494f738cca6e17bb23a7881c439cc1869a793e7bd034eb43b2af3b636b782572179ed4fbcac2880868021da58189f2
- TLSH T148E060C3A0079A202F09C2C804FC0BACF0CE1FEE0D0ACA09C00CE00A591CC2280AEC3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\settings.ini
- Size 1KB
- SHA256 85959cff05d539d32bb9e5601687d315b400d555c3369815339896584a4814f4
- MD5 a9784f73d2efaa333011ffb6e31d23ff
- SHA1 140240e97e11b36ec444a9d834eb3baba697fbae
- SHA512 a4ff9a637fbf5160c738afa956c687ccea0fdc457174866768030b7f97af23f8b3f0bfb6e60b16ce503e2e5500a64cd79a5b4fae4517651ffe36064f5998fe9b
- TLSH T18C313515570082782FD803AFA8B185FDB3E116489560C4305A9FE88B7F8781D6DEE077
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\settings.ini
- Size 1KB
- SHA256 25305044e1db2192b34bfbca40f3b99a112c56d967e69a5d058e976c5588de63
- MD5 e1833e51b010d51d977cf2d254606aeb
- SHA1 db967ccc1f9e647cd4200b63fd2acc339320c8b8
- SHA512 d47a0ec3e85e7e69c81372985525726ee109a75798a9580dd90736c082236161bf22be662f65004c1c43d23a4eba7b3519dd6abf9238f796cf85746df3bd2c6d
- TLSH T191210315570041792FDD03ABE8B185FDB3E116449160C4705A8F9897BF8751D5DEF07B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\RevoUnPro.exe
- Size 24.1MB
- SHA256 ccfd11d2a73602edf17f342851fed25d1121ef1a5b3e4e89cecf246a209e2767
- MD5 967fcc1b34a4c13c5d6edab866d74ceb
- SHA1 656ed69a5b4b8d40594135e7de3254d98263fcb6
- SHA512 ba2055906b675cf08ec25d02a2d1c728caa68057ff12eaf2176976175c2885d8a4a6996257e9e30805502b3d53dfc8ca829f0aa487f11fe14950f6c0e8cecabb
- SSDEEP 196608:/FDWbJ+qN3CmoM+n6Pqp2s5T6rzvuPTxhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIf:/FK1+qN2Mk6PqoshXFhlqPWpyR1pVU
- TLSH T1E9474BB2D94184CCD91C9675CE1E89FDDEB27C16AFA089AF90043C51EDB32D09E3E259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\Win10\revoflt.inf
- Size 2KB
- SHA256 084309301ca31fc8384e97b30f0867559fbd20c38772e1ff7573d24bbc1a0833
- MD5 5187ac55870310aff60ed802a729a31a
- SHA1 cea83a2959cfac57c75df6bd9618e71fe9f481ca
- SHA512 70d1c28d87f223ecd93196aeb1c96591095b6a5c41ade2cf11c08182fe872986206706f7bf2f72f44d16803dcf593249872add4724af13ef7bb328a48c6cdb73
- TLSH T10C51BC98CB9795746A8B32535F133CC3BA212004D1F6300836EE85D8D785A5E87B5BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x86\revoflt.inf
- Size 2KB
- SHA256 69569b4b111035cd35186da239d8241cf96350f6bb296210368ebc570fa2162b
- MD5 edc78deb34de240c787b1011161e9a4e
- SHA1 2d31275530dce33d3bc329991c8ad59e1b303577
- SHA512 e55eefcc39b7353ef11a778910400c5c85cab9657bb350840988cbbf556dc343a9c1803442643c9255c149f8d93a5c2d2e6c3bea244f67c895e635eaec0a0f7b
- TLSH T12F51BC98CB9795746A8B32535F132CC3BA212010D1F6300836DE85D8D785A5E87B57EF
- MD5 SHA1 SHA512 TLSH