da68f767216f321135f8512abb3a4c09a2f416f76e4f8eae3f6b0d4d4854b851

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-01_ec25c19ddab142db47f90639a1647f8d_elex_wannacry.exe
Size 18KB
Sample260501-149kcaev2z
SHA256 da68f767216f321135f8512abb3a4c09a2f416f76e4f8eae3f6b0d4d4854b851
MD5 ec25c19ddab142db47f90639a1647f8d
SHA1 5d6e64077980912bea2f035514ea952c296152f6
SHA512 6968c098e2dafed261f22528aafea41f8b52b16ad462a3da9cfcb78a8b15fd9cd59246601f38351f1f2db8e66210d1d1edccc402a56c0e243898a0611d57825b
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFyHOcCG:1NIlcanKw9hQ97
TLSH
T17B9284396FDA4EB2D377CAB289F7A2C6A932B4237D03191D805D07059C13B63AD91E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	2026-05-01_ec25c19ddab142db47f90639a1647f8d_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	ieupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-01_ec25c19ddab142db47f90639a1647f8d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4396	3668	2026-05-01_ec25c19ddab142db47f90639a1647f8d_elex_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-01_ec25c19ddab142db47f90639a1647f8d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-01_ec25c19ddab142db47f90639a1647f8d_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ieupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
Size 19KB
SHA256 c560536ff0c522eb1197c992739b16dda90f95d1d950c3ab31fc220752e00eb0
MD5 1050dbdf69f8c2665ee8f77d9091f1cc
SHA1 5f51ebba95e410e6e8bf02272396f8240016a3ca
SHA512 d409e70df3d8c54de852cb74bc24a979e5eaeeec474110e48dbfed713a2614bd9751fe6f062949b2173b4064ae2a368cd1a233947a629bdec10be7b20d1d3b40
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFyHOcCT:1NIlcanKw9hQ9O
TLSH
T1949284396FDA0EB2D377CAB289F7A2C6A932B4237D03191D805D07059C13B63AD91E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download