Overview

overview

7

Static

static

3

2026-11-07...ry.exe

windows10-2004-x64

7

2026-11-07...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/11/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-07_1bfb8e13ce8ef5e8bd76363b01f5c727_elex_mimic_wannacry.exe
  • Size 9.2MB
  • Sample261107-tx163ads41
  • SHA256 4a992a9779b47e6ce882ee2dbb2a1014dbbc3e4a17d75a471698726be59865cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-07_1bfb8e13ce8ef5e8bd76363b01f5c727_elex_mimic_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-07_1bfb8e13ce8ef5e8bd76363b01f5c727_elex_mimic_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 7422c6f61d48d645537738f651e101ee017a96688513fe53cb684fd4adbeefd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 bb61f31d83f26a99101ab19dc5e371d0c8b034c60e090fdaf30a5b72565a124d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 6264dc32e22109006b1e620271cbea635938bf52a689eb950d55b479213e0faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 0400de54a3ad9ceb3288de078cd5aa577f1b4405156584ff1c5e7041dad5c3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 c0501af24e88f28190029a693034ce24136d96a970e8438f8130593e513157bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 4ce2dd699429ee0bc9e0767f74d433c11faa51839a0b187d0757791a38ffb266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 c6f66e52630af6dcf88358d595a5b3c687be98e8c318c587c25ff36f78b1084c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 59f7b959134306de67eed9e4cf1540694fa1fd3c9e681686de428d400a04902e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 849KB
        • SHA256 c8b3d8f1c14fb4681e2117ddcf329ce337315b40b926768a532805f7131879b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 e6e193f49dc27d347a2083b74b98a574c44faccc523446e83457703f3135130d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 768KB
        • SHA256 52af0d334236f95e6b46aee8192961922e0c39ce1c167c3c4c41b23d3980b145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 615e5cba096e6cfcd1c65a2a4f38b422ece69c0939226e15e2867b53eda0e141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 861KB
        • SHA256 09360b9afab156745f37f86114f2a127ac72ba5af05519c344f634faaaf0e46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 b00faf4b5a39cb4c6b608f903b8994352c75c1354b03808fb10f2f35d721c32b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 29ed2de02df76a6bef6746659cd84763f4ffe24cb66972f15b20cd38ea57b4a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 59c582f37a053467ae394cb6080ce8d32320699ac579d9512ba4142c866624a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 77bb1bfffba9db36d20d8835e17be784c5942e6c8c3b27358b4e16de8be3ce10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 d0b62c5a99e585b5acf6f80c02af5ae7ea9c8b75600a3addb706cb320a629a73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 cfd8d2d6bb18cbe67f790cb14d1537353fc8f2bae9b3ef9b5748887f7a1d11e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 3f3383eb709d7f29eeb000c169022513b512e87b72483f7c4224ba402f66ff22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 902KB
        • SHA256 9b6eec7dd876519e7797d6ea84d28e3de6462252f9baa5ecf58aa7f8e4d2495d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 825KB
        • SHA256 d3668be26f673bed5b84247573dabdd4c3dbbc67f77e775fc8907f6803f05b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 572f35ae7c448d005cede54fc73dc8a7adb5838aefd77652375445e20cb32716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 5069f88a95c7cd552ba675f4c2a45850b4907d0071442010f687dd4cf0e58071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 962KB
        • SHA256 67ad48a15a95c015e5e938bfc00d17df12103920334ca374578f0f9c76d92a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 ee0daeb353a6082138dbd8580a502f827319a59edfee99fb8211567686aa0565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4200-6-0x00000000025F0000-0x0000000002675000-memory.dmp
        Download

        memory/4200-0-0x0000000002380000-0x00000000024C9000-memory.dmp
        Download

        memory/4200-1-0x00000000025F0000-0x0000000002675000-memory.dmp
        Download

        memory/4200-8-0x00000000025F0000-0x0000000002675000-memory.dmp
        Download