ad62c3675a94df28e39f561b77d5762c53fc47feb382b80fcbabd6e98b88fc7f

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_a4285a104e5d720a6f494b0aa496706c_elex_upatre_wannacry.exe
Size 40KB
Sample260420-e9qhrshs3k
SHA256 ad62c3675a94df28e39f561b77d5762c53fc47feb382b80fcbabd6e98b88fc7f
MD5 a4285a104e5d720a6f494b0aa496706c
SHA1 56ffb251854c37e9f6512a2c9730935304e4f698
SHA512 6ae400fa2dc37f6181dc82f7ca8cb839d6ca90e016d7eea7f13fb06145650b0295f64c3c72ff7e7033a39b9a5347d13d0d36a5524bf7f47d38d6f9aab0cecd44
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLdf5:AC2tUZdHAMEyngXtXdB
TLSH
T14F139A3CAED55572E37BDAB6C5F640CAF969BD233902680E508A33400833F97EDA151E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	2026-04-20_a4285a104e5d720a6f494b0aa496706c_elex_upatre_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4452	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_a4285a104e5d720a6f494b0aa496706c_elex_upatre_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4452	4876	2026-04-20_a4285a104e5d720a6f494b0aa496706c_elex_upatre_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-20_a4285a104e5d720a6f494b0aa496706c_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_a4285a104e5d720a6f494b0aa496706c_elex_upatre_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 40KB
SHA256 b25f8acaeb1860019341dcdb2f733163af5e24f29d792a5e5eb915e40e8314d2
MD5 573861aa16bd587415ec81924ec8ae96
SHA1 6d50558f0ce763a2d9262ebb57b3a13437e524e8
SHA512 79142c6b7e97c1fcef87f7e348ceea5bd14d05b11125c72c5704b32ecde095949f9ea32d0e72c6dc148b095667026bcc997c2dca1cfd0ff4e948370774a39db4
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLdf7:AC2tUZdHAMEyngXtXdj
TLSH
T1FE139A3CAED55572E37BDAB6C5F640CAF969BD233902680E508A33410833F97EDA151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download