Overview

overview

10

Static

static

5

2026-11-11...ry.exe

windows10-2004-x64

10

2026-11-11...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 15:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-11_2cc8d233b6ec68e8591fa79ec7c5175d_elex_wannacry.exe
  • Size 784KB
  • Sample261113-sgcm4acz2w
  • SHA256 a9dbfc7d36b15df9e5cbda41d135fc40d6aaa43803f31f8d88882cb0fcd239a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-11_2cc8d233b6ec68e8591fa79ec7c5175d_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-11_2cc8d233b6ec68e8591fa79ec7c5175d_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5728

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 cc2eaee36feabadee5ed724560e6d5473aa037d0e36145257f83a35db377c7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 f6c29f0b1791fcb2cbc60165f93ff75fa1a789209dcd240d629fe930dfa311bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 f305a944d8d2667d78860c7cf9dce04835f2e568fa153317aa173955352bd794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 7cbbac983869e82353b686f08910af3d6b74720d3f88e8e75916491ed73579e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 6b31670bf170a3fff9405a9537445655fffa9228f91892d10684bf6ed39f62ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 5e49142690568cc6738a015c3dbd35cb1d96b76a292c6bc36cb9f29034ea5dda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 0e82d523c291fa192ff7897a2929bedf6c8251d1210e1c41ec10fe1dc69b0e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 9eeb715402176bee08926a53b574b7f19b53da8fc870579611f325706277947f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 33999c2a090c4fbf5ca22a9635c881058ce60917f42e5c14df088c5f69e6f12a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 0b854117c46e1af4a44f3310d688b7bfb40029d587cef6f159fa1b93726a9a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 9936ce2482907710bf19afdbe2d6a61fb0890b54925dcfac1b9a9899933c701f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 86aedcd5388f2707260e9119960d1e0674aee8bc0e06db2d5e77a9e2acc46a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 6cd18103012783c1dc3e177ed47ce3c1b831f6fe95e84c9351935199260fe9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 727e766b12eb8b4865712a96807a719c0824d574cba408bf196890e5874b72a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 b5ff6b2de048c4e69121c9a6084500a0e80e8441425339a26660bf97c01d0986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 ec1f68a408ea369da81713cd92a8bc33395b01f9b9e42df3cfabb838aac31ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 57290d97304625dea39dae7fd5d24d8f62a5c953301d5f1025f918e4297d4e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 001c9e5c0137fff6f6f31e6c0719149942c700f0c4ea1d71748e84aa53df3c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 2e7f9160611d4b20f39ee6e6a6f68368d2a2dd771dcac50c7650390090d541d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 79e96e6990258ac6dcd1840172820ebc104ec59628f0afb4443341c3cad3367d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 c36882d59321f79da5f3399ae4a906e1fdcfd377c2f2e67d69bb771342c70bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 34c2df17aca4f3a9c13e633a4ad2a071b159b5ff09027bae35dad498dfcd9712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 cb2383cc78e2566b8abc5445916cad251c403ea9d329acd5eb576054fa70aaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 34945fb0505bf65aeec46ac8cca35afb76c141dcc7f370a44cfaf941a17aac2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 fe5db793098450bc7ab2901b6d2ff0d737761b40d3190cbac885ff509fd2ad63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 1cad663f29bcca879174879ce8d9df12927aa1b2a79a51bfff071fc8bcae2774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 74e273ccbe0f6cc52ab091f22d1c4be70927f820a3ecbb2d24120a97c0e44955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 f40c9617f9264201e03324bd7b8f2eeaf0ff1cc084fce246ab30137048772cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5728-0-0x0000000000400000-0x00000000004CF000-memory.dmp
        Download

        memory/5728-13-0x0000000000400000-0x00000000004CF000-memory.dmp
        Download

        memory/5728-7-0x00000000024C0000-0x0000000002545000-memory.dmp
        Download

        memory/5728-1-0x00000000024C0000-0x0000000002545000-memory.dmp
        Download