Overview

overview

7

Static

static

5

2026-10-22...ry.exe

windows10-2004-x64

7

2026-10-22...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 15:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_3ce31213f9f1043d0eca0407aa447651_elex_wannacry.exe
  • Size 784KB
  • Sample261024-te38pszy3r
  • SHA256 6cdeae7c83ddf656ec06575fc2493a666353cca7b4c413fbf0b2c1964651082a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_3ce31213f9f1043d0eca0407aa447651_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_3ce31213f9f1043d0eca0407aa447651_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 214391c94220df481d9de662509a81ece09a9bf5cf994beae510fe4c5f90bb18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 a48240bc8bd26f7688e2c70b4ce0412282048745953a28237b09d25d5ade661e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 2287b0e604f90ce00d5884f75216c583b51c97bda21e9c8e1703c7e527d4d562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 ce9f479ccc1f066e394e9942930d554f0291b3fcb1e7073bb43ad319442d2ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 0710838ad8b27176b235b4c9d2b9743a197981255a7ab001c0c0ee2cbf75ff83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 c05fef6901121e844ed4bdfcb3902ca42c4417161ec642232c4f303be209d5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 3e956c19e937c53537e62d6219eb216b91972f7c90f663841fd9f941b3cb1e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 ed260ca924798758088ca8d08c4b769a213bea3e7a8d9b4a41bc8a27c54aad67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 36d5ea0d820b42f0e4545b9aabd22186356c18771647748c7ae4fa83aae86fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 ab8f5fd5ac9976e7a2fa26e1acfaebdc96529c82e7e0e5f89d6abd566fcc6044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 a87b7d6cfb3b61a4432881f0b3ee986ea4ce9939a7d35aacfd504b0acf4500f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 ca0afb678b8f705b4802b3b62cb499cf5fc3312cab5dd64b1a58453151638d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 b676e431f11d21b925f23e7f937770ab8b6155e56f1d786257861ab6ff099f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 d647810a8e166a536ece11438120a0d782d578ce268ecacdd7b6cc360dbf192a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 670d1c4c58bb1e2afc1600d376ef5c94b77f441da60ee83bf9b590da3997a1e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 353f31bfc3060cc2ae8604b0f0bdbc5ef898c024ada0f9243b250de500bee9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 4f1b0e736aec1ba7ed18decaf7e690bec3839372418397fbfb623397d1869adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 eaa68275379f45afeb9505d85750d4ddc8636dbc579faeb551a103a9c3aaaa32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 8bb85886929ed771ee270c75bbe933be1caab8a0abba4c9cad1ad5217b252068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 af6424cc082a8391b3c9f8d1ee59c6a2e395d35eadb02ffce9844af0941c1f77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 b8fc0f266eff3bd9a11ac4e66526f1f731d62321418e6db9746247f72e11ddc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 38e1a562175a7892bd91c8a88888dd6de3bb40baa4484f5b99f19ca59b0f443f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 131b9a7fe8c154e063e7cdb64acd061383ddfcdb29766069f95b11ce6342ef24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 c3d4cd819c65f792c6d45fd99e99ff92f280db82bb5d16631c2ec53000e2fcdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 4cf98693e028f791cae1a89d084ea31bcdda279bc0354fe5323fe358d5450e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 054a9608308c4379bba356f107387b4c00979583843146e59845c7704f246add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 a8d4173f3d540696df20205e9d661c8cc0bb05d4dd8d7d946a7fb2abbc4ee7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 98a34e7cbaeef9d6cac67d1247214b52258bee5f3dc0e727877c01f8bdc5a547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3864-13-0x0000000000400000-0x00000000004CF000-memory.dmp
        Download

        memory/3864-0-0x0000000000400000-0x00000000004CF000-memory.dmp
        Download

        memory/3864-8-0x0000000002520000-0x00000000025A5000-memory.dmp
        Download

        memory/3864-1-0x0000000002520000-0x00000000025A5000-memory.dmp
        Download

        memory/3864-6-0x0000000002520000-0x00000000025A5000-memory.dmp
        Download