waski | 9ff8ca992b76163b25aff09684017309fc773ba038c2f53ca92911a34422dc26

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_059fb903a32a7036c827b50df1830f00_elex_wannacry.exe
Size 35KB
Sample260425-kdthfab19v
SHA256 9ff8ca992b76163b25aff09684017309fc773ba038c2f53ca92911a34422dc26
MD5 059fb903a32a7036c827b50df1830f00
SHA1 52dc02d0ab63674a2345fdc975aa470c4bc9b3ce
SHA512 d0cb1d701dcbf7bf61271cc7e28b6605422da71ea776c68c06ff33f54f8caa68bc09e7e347894ccdfaab4464eaca94b9939f5b4067acc2929bd0025bbdceb51c
SSDEEP 768:uxckEEd62J798jBk3A6gow6vdBcl5sfuW5nrA8zjc52WM:cc3ji6kgi1Bc7sR584jfWM
TLSH
T147F2AD3C6EE91972D3BBDAB6C6F691C6BD75B4233D02580E408647840C23F26EDA1B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001f00000002b172-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
1052	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_059fb903a32a7036c827b50df1830f00_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1052	3020	2026-04-25_059fb903a32a7036c827b50df1830f00_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_059fb903a32a7036c827b50df1830f00_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_059fb903a32a7036c827b50df1830f00_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 35KB
SHA256 86398eb3bed5204301d178f3794f7d36a8f60a71ae080dccad8d7b4a35908d88
MD5 5e572e6ede938c90b71b06425e8ca622
SHA1 f6c2898d8a874cf262266e02b380cd29d77d501c
SHA512 f2b1a6edb8053bef425e38fe3a28d57a1c7c642f9cdb269372694397e22c52c9c263939250d9821606551fed37f9a590b1ac5497d2b4f86e595083e45ad37821
SSDEEP 768:uxckEEd62J798jBk3A6gow6vdBcl5sfuW5nrA8zjc52W7:cc3ji6kgi1Bc7sR584jfW7
TLSH
T1B4F2AD386EE91972D3BBDAB6C6F691C6BD75B4233D02580E408647840C23F26EDA1B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-9-0x00000000025D0000-0x000000000264A000-memory.dmp

Download

memory/3020-7-0x0000000002620000-0x000000000269A000-memory.dmp