Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 02:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe
- Size 11.4MB
- Sample261024-ckheraea65
- SHA256 2f79bbb98234656faab1310f685cf39521e5d48e37c231dd6db9c4982a0b10a5
- MD5 a3e8d2780ab865de359041966f2674e1
- SHA1 e93c90c7c51956e7062541abf3ba235a8b1a6d95
- SHA512 fc513f3e7dff9e994136d42b98ba3d51f445b16b719f26d5a53ac45ea62ce062df412ef2d5897d363cea40b440946ae13ca5f8b482f5eb56ddb6550cb79c6309
- SSDEEP 196608:15aF+3CoFGoYt2Hys68rSHeDqbdxlQOoSAOmantbVZFAz9ON/y5S8e:15awCQrYtS68ZDUo1OVntbVZFAzq
- TLSH T101C633063F6FB4F9E29644F48541FBA946EDE4B44BC8969389C1AA056E331C9F13D0CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c567-77.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Executes dropped EXE 2 IoCs
pid Process 896 RevoUPPort.exe 3752 RevoUnPro.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico RevoUnPro.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RevoUPPort.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe 3752 RevoUnPro.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5944 wrote to memory of 896 5944 2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe 90 PID 896 wrote to memory of 3752 896 RevoUPPort.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3e8d2780ab865de359041966f2674e1_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\RevoUPPort.exe"C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\RevoUPPort.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\RevoUnPro.exe"C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\RevoUnPro.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\Data\ZBPJFCBQ_Admin_4057491610-3392471755-192832105-1000\RUPBackUpData.ini
- Size 166B
- SHA256 9269ab912708edfed0a1a67585e355e5f01e461d34704d221c1b85c4fedf76ef
- MD5 37f82bce620363376891d5e279fee17a
- SHA1 d3ba83da02621bba0c6a265ba92d174c009d73aa
- SHA512 0d99bc3c3ded414310db71fc7d4bb986e77f15286a62b1fb2d8d758f15dc808ae97a25cb147293d069f3b58ca18ef33bc031ca5f0f74494752ec652f7272a91c
- TLSH T1A8C0486787FA0565F4F76F24DAB802B24BB03C08783AE08D01E0021E89F168090A27B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\Data\ZBPJFCBQ_Admin_4057491610-3392471755-192832105-1000\RUPHistoryData.ini
- Size 144B
- SHA256 671e39f684ab5454a383b9a6804128f599b298ef197253440ef33942dc3de953
- MD5 b772c396e2ba81c75aacb486633b4f82
- SHA1 7fa0275d243ff34ce55a0c351bb3556679523f3e
- SHA512 c63ee4aa6a8ed2c1b5dc9bcb0da41cdaa7ec17b4590f9812b0c0df0fbb974e23be0a15e9e50bf71ac70068abe6304d7e0ba67aa54c83f372b2837cbe55f48c37
- TLSH T151C0926793FD40A8F4F32714ED3805B30B75BC04267AD08C00D4021D08F024480A23B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\Data\ZBPJFCBQ_Admin_4057491610-3392471755-192832105-1000\data\cachedata.dat
- Size 43KB
- SHA256 05fd7cb5cbb641560373b980059d0f29847046d99072a0706f763bacdfbec77a
- MD5 61cd5d078a85408b420acf88dcb214c2
- SHA1 aab729e8237179a4759b18fc054b25af89202654
- SHA512 342fe1103ca9fa077af3b31a357ef31423da307cc889e7b62868cd570681eb715457e94ca8bceee4affd06e3ee0933e3d7c95665bb47a0033ff88338229507bd
- SSDEEP 768:9/JWiMTyhlsw2HcJZjgUXnm8jleyHwS1aEqR:9JXnmR
- TLSH T111138B286BF91626F2B7EE764EF48527A936FC51BD218E1D0152074A0532D13ACA1F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\RevoUPPort.exe
- Size 172KB
- SHA256 ec8070594d12fd76aaf18476488e3f24ecdb08830d26004ef6b90e41abda6fd9
- MD5 984f51ec99705062fe068dc4bef3fbbc
- SHA1 2a617dfdee0d0bdf76556a2d0a3bd1f27e9038a5
- SHA512 68e029bd81a147df137cc0d8abca472b826856fcbab5470fbe9fe63d866a3fffe6f1002d10c0a1cdf31b275dee5b5ed188d750325eb99f05848d953bd28f7edb
- SSDEEP 3072:QZS1ODHhmmm/DiLgweak5yJcDK5io5RljzolzXZSx09FeR:QS1pU4qjzoVkx2s
- TLSH T1FA04AE43B9C098B0D8360E302460D9A5A93FBE115F658DBB7754632F6F34181AE39F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\allp_report.dat
- Size 1KB
- SHA256 f74fbf45b1e400572b068a7ca4e66d8a21abc3a22e901f3f2a1f6dccf680beae
- MD5 2a8a6ba4ac1ad6ccdbd5eb8f9b66943a
- SHA1 9cabe7afa81a9d52c2ce41b3d655cf55530cb21f
- SHA512 cfc4648abe509da7dcd9a2305b84452130bcf43bb3e8c03c26396111701d699680aa60285e773a3818bcfe0f54cbe39358770bae9da5fa0fcd86fc7ad06b915b
- TLSH T148311FAA77FF56C4F0F74F33D51A5A2156B9BCF83930A1A9734B02AD44B258848A0733
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\ctrlbars.dat
- Size 638B
- SHA256 be791752cf43ef1d366770c2473eccfa9cebdaa09bf3c8afc03e7dc70f1896a8
- MD5 95973429f111cd497ab6e33aed33c4b5
- SHA1 7adbf116c5df9fe663cb94da1c68f048e4bd3d91
- SHA512 24d4051c3d7427bfa978588a27305ba5ec9accd22452f5d5bb9601ed8e1b262fe8f6de0a79da76ffd44ed864df088c9c148bf89a31a60a5eb7e1db6b841838df
- TLSH T127F06527F760C201D8108231189D9BE65295FC109E754B43B013B34D0EB1140CCC5E4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\lang\english.ini
- Size 123KB
- SHA256 f0f1890de8a60f87297d6de21146977060a3b5d82e09523bced0c238e94f5d2e
- MD5 00d7babcb1fca39669a305acc4e6bc4e
- SHA1 caa71de90128acf6e8d812e02aa8ba4622bf8454
- SHA512 9f1348f6ee7325b7d3381865bda4d71807da45c941c3b40c7671df04a6558832dfd03f25f5664250b43b641117d7d3d7c71f7e81b747cbc559fc5b8169033f66
- SSDEEP 1536:yG6KyyErUp+ihmoqVl4hi7bFwlBB9YK3zZ1lvE:yGXy3rVCmoqVlcilyB0KjO
- TLSH T1E5C3AC5267F80119F6F77F54AEB506714E77BC9AAD38D64C0280058E2AF1E40E8B277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\license.dat
- Size 368B
- SHA256 cc933f5b096ac5868e35b4a083cf4731094fe09458696d5277fbd924009a8507
- MD5 ecf5774bcb2d29d042f7a752fcd0df2d
- SHA1 ec957331a29d5fe8d927ff0ed6ad2144ab390a5e
- SHA512 a08c0d6b7af7eeb19ddb96ed8fdfbbed75494f738cca6e17bb23a7881c439cc1869a793e7bd034eb43b2af3b636b782572179ed4fbcac2880868021da58189f2
- TLSH T148E060C3A0079A202F09C2C804FC0BACF0CE1FEE0D0ACA09C00CE00A591CC2280AEC3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\rupilogs.rupldb
- Size 18.8MB
- SHA256 e786fa86db21a4ffe8f78ebf032715390c05d1edbdb6c90fef75e0ed3d946cd3
- MD5 e821132dbece4d288d3b1b3b68373b3a
- SHA1 dac86f72e5c2aaeb5efdfea06bf9c5def980c74e
- SHA512 4701788f4a91f76f3a63843935df5a8f80535d85ff0f760af86c21601d73b40f8c4d00a883dc64e50482c201bb7d4f3867a038223593227ac79aa14520f2068e
- SSDEEP 49152:GEKRfz9PgHG9uUkqS/cmsLPGkLgHfC8wlPWz88RlfpwrjsWWv89uwbSzAMZo6h8e:GRfB2upPBxAUg/Jb9R
- TLSH T1B8173B426C1AC2E0FA0256F637066E572B4B9B4972CC423A33EDCF5FD5C6E5442ED2A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\settings.ini
- Size 1KB
- SHA256 607b427ec50be43bd577b3382468f432598934a94014f02d5ac788d920295738
- MD5 092baaf25a94a28eeea621173e18d014
- SHA1 be83c689af27550aafab29840e19ae850cc62bf1
- SHA512 f9115c4cf9a881cece564bb0164b8d1bead9b17062b9527c348a86f177124a53027e677cbc9ea30c3b9116136c7b8046c7b210ebb94334727d65e9510fbff7e4
- TLSH T1B3313514570042792E9903AFA97185FDB7E216489160C4305A8FE8D77F8781DADEB03B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\settings.ini
- Size 1KB
- SHA256 25305044e1db2192b34bfbca40f3b99a112c56d967e69a5d058e976c5588de63
- MD5 e1833e51b010d51d977cf2d254606aeb
- SHA1 db967ccc1f9e647cd4200b63fd2acc339320c8b8
- SHA512 d47a0ec3e85e7e69c81372985525726ee109a75798a9580dd90736c082236161bf22be662f65004c1c43d23a4eba7b3519dd6abf9238f796cf85746df3bd2c6d
- TLSH T191210315570041792FDD03ABE8B185FDB3E116449160C4705A8F9897BF8751D5DEF07B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\RevoUnPro.exe
- Size 24.1MB
- SHA256 ccfd11d2a73602edf17f342851fed25d1121ef1a5b3e4e89cecf246a209e2767
- MD5 967fcc1b34a4c13c5d6edab866d74ceb
- SHA1 656ed69a5b4b8d40594135e7de3254d98263fcb6
- SHA512 ba2055906b675cf08ec25d02a2d1c728caa68057ff12eaf2176976175c2885d8a4a6996257e9e30805502b3d53dfc8ca829f0aa487f11fe14950f6c0e8cecabb
- SSDEEP 196608:/FDWbJ+qN3CmoM+n6Pqp2s5T6rzvuPTxhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIf:/FK1+qN2Mk6PqoshXFhlqPWpyR1pVU
- TLSH T1E9474BB2D94184CCD91C9675CE1E89FDDEB27C16AFA089AF90043C51EDB32D09E3E259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x64\Win10\revoflt.inf
- Size 2KB
- SHA256 084309301ca31fc8384e97b30f0867559fbd20c38772e1ff7573d24bbc1a0833
- MD5 5187ac55870310aff60ed802a729a31a
- SHA1 cea83a2959cfac57c75df6bd9618e71fe9f481ca
- SHA512 70d1c28d87f223ecd93196aeb1c96591095b6a5c41ade2cf11c08182fe872986206706f7bf2f72f44d16803dcf593249872add4724af13ef7bb328a48c6cdb73
- TLSH T10C51BC98CB9795746A8B32535F133CC3BA212004D1F6300836EE85D8D785A5E87B5BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro\x86\revoflt.inf
- Size 2KB
- SHA256 69569b4b111035cd35186da239d8241cf96350f6bb296210368ebc570fa2162b
- MD5 edc78deb34de240c787b1011161e9a4e
- SHA1 2d31275530dce33d3bc329991c8ad59e1b303577
- SHA512 e55eefcc39b7353ef11a778910400c5c85cab9657bb350840988cbbf556dc343a9c1803442643c9255c149f8d93a5c2d2e6c3bea244f67c895e635eaec0a0f7b
- TLSH T12F51BC98CB9795746A8B32535F132CC3BA212010D1F6300836DE85D8D785A5E87B57EF
- MD5 SHA1 SHA512 TLSH