9c9943e50b9e633eb2e7a5c24f1892bdfc1181f1b8b558880e9bf4e0adb99bbf

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_5cb24cbd878b7934e65761aa5f47b73d_elex_upatre_wannacry.exe
Size 91KB
Sample260416-ce3thad13l
SHA256 9c9943e50b9e633eb2e7a5c24f1892bdfc1181f1b8b558880e9bf4e0adb99bbf
MD5 5cb24cbd878b7934e65761aa5f47b73d
SHA1 a465e6e72063f42870c07ff960bcbe9e806a36be
SHA512 a080974a7622b02fe4bd866d7b83083b0f4ce763b60425c6ff569c9644a1ed4bc1fa74a4b84e1eef80ec7a3245e7f36e2916c22584dc96e69b332dfe5110f432
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbw:EAYeTpp
TLSH
T17F93D37CAEE92672D3BBDABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5056	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_5cb24cbd878b7934e65761aa5f47b73d_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 5056	3368	2026-04-16_5cb24cbd878b7934e65761aa5f47b73d_elex_upatre_wannacry.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-04-16_5cb24cbd878b7934e65761aa5f47b73d_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_5cb24cbd878b7934e65761aa5f47b73d_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 91KB
SHA256 b89bbac1ef5e1f5a7244cdb3647c24e4c7410ba58d3d24b355304b448b251b50
MD5 794c00a5ef7dc3441f5d7336906d250b
SHA1 066bfb70df0efce39cc4ce1d05ee729f478c9d71
SHA512 61a2e384ffcac7e308dbd6b8401b3370842f9f80ce918a470e3f97b56b3b503f4ce99cf8a894e95384d7b6f1499c09957c66ec006f92ded5b6863de9d0042e85
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbs:EAYeTp9
TLSH
T10793D37CAEE92672D3BBDABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3368-0-0x0000000000403000-0x0000000000404000-memory.dmp

Download

memory/5056-9-0x0000000000400000-0x0000000000407000-memory.dmp