e51dd7aeb3af0e7393e4fe7ac2404997ce47ca370a8622b205a53bd94bd1edb4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_f4db0639ace5fe96ff7e7a93ed9c2f04_elex_wannacry.exe
Size 21KB
Sample260503-jtkd2ag19q
SHA256 e51dd7aeb3af0e7393e4fe7ac2404997ce47ca370a8622b205a53bd94bd1edb4
MD5 f4db0639ace5fe96ff7e7a93ed9c2f04
SHA1 d86aa54834f964c299a9df7153216cca9e4d85ca
SHA512 9dd8cbf221a84128c396a7b1c5b0ba84e31a7a490a1a93c7364c56586db10b18500c79d00f4c42bc5324b78d53bb918502e6a8c7a81e79020300ab8461589ff5
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJSwV:nYfoKSs71dv4/00CeuYD
TLSH
T157A2A6396FE91E72D3BBCBB649F392C5AD39B02379035D0DD48117498827A42EC91E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5244	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_f4db0639ace5fe96ff7e7a93ed9c2f04_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 5244	5532	2026-05-03_f4db0639ace5fe96ff7e7a93ed9c2f04_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-03_f4db0639ace5fe96ff7e7a93ed9c2f04_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_f4db0639ace5fe96ff7e7a93ed9c2f04_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 21KB
SHA256 76c09029a82272c39e6806da1cecb550e7a66d5317a2e0e7c0a18f73a55a00ba
MD5 959605aa6709620469a7eb28a3b1ba59
SHA1 1f62231840bd7db50519584445301e62b917a660
SHA512 cf72f3876bf96a141b62f2443b0509a76f7b0fdaebcd621bbf73015eaf6e29f338356bcee42299003117d0dec826c4f2275eeb46eaf0f5981b1fa7ffd365ca7b
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJSwe:nYfoKSs71dv4/00CeuYk
TLSH
T18AA2A5396FE91E72D3BBCAB689F392C5AD39B02379035D0DD48107498827A42EC91E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5244-17-0x0000000002220000-0x00000000022FA000-memory.dmp

Download

memory/5532-8-0x00000000021A0000-0x000000000227A000-memory.dmp