Overview

overview

7

Static

static

5

2026-11-03...ry.exe

windows10-2004-x64

7

2026-11-03...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_42ac91f41add940731a4b45ee9496d17_elex_wannacry.exe
  • Size 780KB
  • Sample261104-2e8gesdy5v
  • SHA256 4a939789b198bbac73c31625e29974fa893896d64645149ce23655a1abb37fb1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_42ac91f41add940731a4b45ee9496d17_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_42ac91f41add940731a4b45ee9496d17_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 93e817ac9ddcb74c3d2701aa10de4e4ba306f9992a2ac4a0a3d2157fcb2537d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 df51afae8bd835325ffaa398db91609de42bfcb875b9b5e9e9b7e3773775ddca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 9247b4dadb949552727d29925773b8001dbca58282e57f01621198b9740fb7ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 4.4MB
        • SHA256 7b7471468b02b85deca22f13f3f0d1f0649f9a4d5a7d971884af1b60691290dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 bd603b74a124fd1fbcc024aac48939f05fdecc9f1af87d2872d8e38531a8316f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 aa5e16d524e226b3318715df553fb36764217daaf320d3371c1390000f622935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 777KB
        • SHA256 3fae539f6780e3990a348e527227322e3bc10f5fea6623cf1642a8c92be28d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 d48f2f5057e6e9a4107057e8f0d2f959dba0bb6ed7208f24913ee03c3e9ac60f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 d7697f1a78ef21b5a2620117b6320e11422bf2f6c0543a70f3932eb43e2efa7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 2a11613073285c3245543a5b1d880b4443360798af820bf7fd6a3bdac8930b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 2549d5f6222860f58174aa902a121e96529aa1d1cad38c7199dbfbd89e38c294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 7b91b0f037589b2337a396ec92a0742bf6f005adf094bd522f1343ef4433f8fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 cb91e67098d29ba165d072a40e6f71f691ee08818773cae54d6bf4c9538c0c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 272953238ab69cc9a717cff64d77b868903fd80e642775dd83bfb2f367c14392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 89a9669d2c6565198a0948674f84b982a56cfc4bb887e212d5cf45fd43f4e079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 b95ec37247298d22853b5dbfb8b61d7378e7ed4d04505f77546e9b3f0ed20a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 8445ec9b267ab565bd1fbc34d3b16394c9da4a5e15644e2a556ae24ceeaeffe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 54c1be5d9ddca306aa40c4128f4d13efe3bcae0cf396ac31b37875bfd0dd5ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 143ecaf656ec9c2f79a16bb78fa560ee90d872423f405ae5e51e98eb56e3393b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 20fa982f3aa973f6d32a26868e25e4405b1820f95cb59b0858c4e19e0c695e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 05c9b56765b6c6dbb65a220445265ded1ca6acb5320a137f5eedca06004a6b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 b1be5fcfa9c56384581a56cc327f846b4b3e49b62836bdaf83f4d2896f710675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 5c5ff14a91a5cb9fa0abaa560e28a2c6c70deb41b961be6106139864bc5fbebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 5740697e8ff1f35b2d242cf2d0e6fd58caa3500a2069eba9a14d1a0784b52dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 39a6de3d24de1abaaa009896d2b94e663a6a9d6c46926db11c518229444d95ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 eea9d89d16c5e093ac41e08925ded6d87a57e62fc0c567fca7d8da7df9675f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 9783c930b3c3fe3c89d5fec356b3e56850ce2ebd23ba25086de21812f42a1921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4236-0-0x0000000000400000-0x00000000004CE000-memory.dmp
        Download

        memory/4236-12-0x0000000000400000-0x00000000004CE000-memory.dmp
        Download

        memory/4236-6-0x0000000002350000-0x00000000023D5000-memory.dmp
        Download

        memory/4236-2-0x0000000002350000-0x00000000023D5000-memory.dmp
        Download