3888d63a91c1d486df7ed7c4a4b429465a04f56bf1d546937505bd9d47b27c51

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_50eca415dfd6130eca6e6e1226940999_elex_wannacry.exe
Size 22KB
Sample260421-mhvbmscy3l
SHA256 3888d63a91c1d486df7ed7c4a4b429465a04f56bf1d546937505bd9d47b27c51
MD5 50eca415dfd6130eca6e6e1226940999
SHA1 bf76fbe7b6ecc45c8deb95537dcc473542725daa
SHA512 beeabcc4876241ae19cac748cf3387f4a8abf2fbd36b732d77ba4571b8c31605fc92a3a41069ca9c9bbfdf54944f0aef9da75a5083e63eaa2f46d3e47a7184b2
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzjNqWie+c:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDZ
TLSH
T1CAA2A638C7D99DF6D26781B7C8B2A9911032FF2691211D1EA85A36010CB3643B5E7DBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3328	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_50eca415dfd6130eca6e6e1226940999_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3328	1848	2026-04-21_50eca415dfd6130eca6e6e1226940999_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-21_50eca415dfd6130eca6e6e1226940999_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_50eca415dfd6130eca6e6e1226940999_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 22KB
SHA256 f5a0f111dce5e7ff9c91ce1556a1933398566572cb88854183c02f69e27be984
MD5 4d387dbb8ffdf4df9f4f30d3d97d96c8
SHA1 f957d303e4b18760d8638f100ff74fac248c14fd
SHA512 5b433c0dac84e292a64d368c271e49560135aaf58b48c95d28a6b219c3a647b9cc7fac69e93351e727d466af4d91fa04ae41beafe7c74078a85fd6fe5890c02d
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzjNqWie+Y8B:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDo
TLSH
T125B2B538C7D99DF6D26781B6C8B2A5911032FF2691211D1EA85A36010CB3643B6E3DBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3328-8-0x0000000004220000-0x0000000004227000-memory.dmp

Download