d27f515ad720b7ce369bedf3ef50fa8abc4107bd582e2253b7bfb7137149bea6

Analysis

max time kernel
150s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_8e2bda08382330bbf54293128694700c_elex_upatre_wannacry.exe
Size 42KB
Sample260503-fa6alsft5r
SHA256 d27f515ad720b7ce369bedf3ef50fa8abc4107bd582e2253b7bfb7137149bea6
MD5 8e2bda08382330bbf54293128694700c
SHA1 db5fbadd99ef82ae360401de8d0f5dc68c0b8033
SHA512 0033b221a02a99a21c087ee2ce0b96dec73b25dd52879cb7344dc32079b41f3b3b2eeab72aab697a2b7cfb2ee6ec5f92cd435a4a52db5b758accd557b26aa703
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLh:AC2tUZdHAMEyngXtXh
TLSH
T13113893CAED55572E37BDAB6C5F640CAF969BD223902680E508673400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3892	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_8e2bda08382330bbf54293128694700c_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3892	2856	2026-05-03_8e2bda08382330bbf54293128694700c_elex_upatre_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-03_8e2bda08382330bbf54293128694700c_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_8e2bda08382330bbf54293128694700c_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 42KB
SHA256 a0fcf924270c5c0bd72955ffff918c58c7341fbca7403366dff37e8d824a1d02
MD5 5e29d7f26e3e67d76c338feeaa99f4d1
SHA1 397dd50dd9493ccb69a98b780e0be104d3a5e55d
SHA512 c329b7a81ae4ab289619b85e2b018c5325aa3c68003a7140492a5ee3383379fd3a00558bdf91edfdf89d5f7e01942d35c95164c39a5c7fd1c6521aae654340b0
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLF:AC2tUZdHAMEyngXtXF
TLSH
T1C813893CAED55572E37BDAB6C5F640CAF969BD233902680E508673400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-8-0x0000000000980000-0x0000000000F82000-memory.dmp

Download

memory/3892-9-0x00000000008F0000-0x0000000000EF2000-memory.dmp