6046b389ffd702b63ebccc3147c5e8e6ad6c8c205eb77b649fce1b77c26399dd

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_a6ab6a2f5955c84a18149dd38dc9a829_elex_wannacry.exe
Size 28KB
Sample260503-kl71ssd16t
SHA256 6046b389ffd702b63ebccc3147c5e8e6ad6c8c205eb77b649fce1b77c26399dd
MD5 a6ab6a2f5955c84a18149dd38dc9a829
SHA1 a26b9016c1a751228812b15e8c55b5a14697064d
SHA512 e036ad9bb7b220a69028d2c13cb47dabe74e397722b5b736f66c7107d57c2062d9d8fce81da3f8466a7c198b2651fa52597c7aca5272e64f13981313669b472b
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pqi:Kz2u4LJjBaECkLSi7xsYhaKDViri
TLSH
T1FAD21F38DBD95DB2D37795B6C8F2A5C26872FE22B1111D0D948637010873B43AAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-05-03_a6ab6a2f5955c84a18149dd38dc9a829_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3812	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_a6ab6a2f5955c84a18149dd38dc9a829_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3812	2028	2026-05-03_a6ab6a2f5955c84a18149dd38dc9a829_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-03_a6ab6a2f5955c84a18149dd38dc9a829_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_a6ab6a2f5955c84a18149dd38dc9a829_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 28KB
SHA256 50afc0cb12fb5547cc3cc6559833787559da80689998d7de3823c13dabcf66cb
MD5 88bda52eb70ac157b297dc6972b89c57
SHA1 394a76298a91f69cbb3e4593254eb82124c32ca2
SHA512 5918453a650e6d78d40b32619d8aadc24d307233254ab544fb728fd50bbafc60df4c71f3e45c18e26c08036550b42dde73b63565c3e08008ecd587a507d65826
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pql:Kz2u4LJjBaECkLSi7xsYhaKDVirl
TLSH
T1E3D21E38DBD95DB2D37795B6C8F2A5C26872FE22B1111D0E548637000873B43AAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3812-8-0x0000000004A60000-0x0000000004AA7000-memory.dmp

Download