Overview

overview

7

Static

static

5

2026-11-03...ry.exe

windows10-2004-x64

7

2026-11-03...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/11/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_42ac91f41add940731a4b45ee9496d17_elex_wannacry.exe
  • Size 780KB
  • Sample261104-2e8gesdy5v
  • SHA256 4a939789b198bbac73c31625e29974fa893896d64645149ce23655a1abb37fb1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_42ac91f41add940731a4b45ee9496d17_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_42ac91f41add940731a4b45ee9496d17_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 6c02a131bfe719ee0ac1f95335be3dd1d91b9e74f38db8bb83a940b815de99a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 6bb8abb1f04ca866029f045c1e085b5255264e75ee9978ed4482b3f625bd5e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 1742222ec7d294f59967395f0f8b8eb8c43bcb0b13239c2b2898427006a76a5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 6d117031cd9bcf026947e103093dda5d2476261ce81b5bba6022700fd355bdd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 76eb16ba9c6c0e808e04f422c4519a05ee1ef31889eec8422b661d74fa5af104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 50665c17ef8f6548cc8bf3cb7096142843319d469977ed5fbf679eae5c48de9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 34a1ab6c87d7279bda34d9a6c6e122ddc87e3c5bd74b402a894490111cd12511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 3e474a2da9ee98812f437162d04419b2873bd50929d7b5dfe94d810e7e96d811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 b9d2b316b19cba40e5e2fdf2d61f42d2ba7f7540ac4c2ea044540f0fdc03ebcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 da33a31b29c682b47567d0c01b7f870fefe0950a13dcc625bc51a3198e360e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 60f38991274cb99778b7ed781c41d4c782f9088885b509baf0098062a10b71a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 76c46ed41fbba41bd765d438002ebf281bf3179e83a815429e44ffbaa9d13229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 98883a7ceb3b0da81da5a05b7102c9cad42dabec2f6c2b0c6035a526f20e008f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 a174d5059a36f97bae2c754bc54bd6bd73df9eb9120e4eb1f562d1ffd9e154e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 008277d97f284ffb7691fb2dc81539b22d4766c5d08111b0e5f02a2ab888b49d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 e001d222e6873f622556410e64bb33e4e8a5eb8d21bba800f5066826955cb94f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 18cccae07b0db115948d3bd661931ceb7e7d13054a47e772eed95685ce2f3792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 437b15802b73c6d01455cb5b10fedc794fb7355757a39216b2439562bfe3da56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 a1221d885642476c95bef1d2a2512bc9e28e1a6a7557d1f1b5106d65fed90448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 ebc90703efde4feb4c449b32f733be747351492f91add9b4f4ca5d872d843a43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 1cc4042b3786720a8a2a798ec1b6fed617db89bd40ac00992c5012762d10cc86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 bc4bfc72ccc92a8a8c7f9aa9aa24331a9b2af4e893351d58e1adfdadc59271ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 e3c47b603589f0f7b2ce8aab68883280fe410def0fa3bd745fd1b9ad8d26a57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 3090fd472161a857f16ecfca771f40ab2d908a2d1e45ac3a7e604cbeb14a8b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 e05f772759866e0abdbef6e13a1adb99f8773ce789bc3b15d4046da91ec1f58f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 cdb2ef96c29170d06fb92a03a8f9dafac76d20d2c7fd23a7d9175bcea62d1549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 bb7f1e04842238b399d8bca318be39c87ca6aa9841460d9dbe9869b0b5919d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 20824d5c97155d5c0cece962ea1f2ab289d5080e2b39dcc5f237e45bb280249f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3864-13-0x0000000000400000-0x00000000004CE000-memory.dmp
        Download

        memory/3864-0-0x0000000000400000-0x00000000004CE000-memory.dmp
        Download

        memory/3864-7-0x00000000024A0000-0x0000000002525000-memory.dmp
        Download

        memory/3864-6-0x00000000024A0000-0x0000000002525000-memory.dmp
        Download

        memory/3864-2-0x00000000024A0000-0x0000000002525000-memory.dmp
        Download