31e7225df87d2fe989f1663f8b5719d506ea5f67798c909f5d0d7e00873bed56

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_299ad9c9b66b8a68ac3a3376a749c752_elex_wannacry.exe
Size 22KB
Sample260506-jctldacy2t
SHA256 31e7225df87d2fe989f1663f8b5719d506ea5f67798c909f5d0d7e00873bed56
MD5 299ad9c9b66b8a68ac3a3376a749c752
SHA1 497e2a95dae4ed76623c0fe12d8a57e6d5142c8d
SHA512 8c2f9a5d286b0a9171074a30a3cbe81760a47388a6dd1c159c52dcb6ec62802ab400160ce0f32fef23f4b23c76a10cfd59217b673e171b338abdc8565e5b0b6a
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzjNqWie+Uk:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDe
TLSH
T158A2B538C7D99DF6D36781B7C8B2A9911032FF2691211D1EA85A36010CB3643B5E7DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1984	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_299ad9c9b66b8a68ac3a3376a749c752_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 1984	5324	2026-05-06_299ad9c9b66b8a68ac3a3376a749c752_elex_wannacry.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-06_299ad9c9b66b8a68ac3a3376a749c752_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_299ad9c9b66b8a68ac3a3376a749c752_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 23KB
SHA256 d9df418b366e0297c13f146b43f7cd0bc3be1635c186d1e38a7c720cb9bb9d72
MD5 63dc47dc86d9304afaf72bfd8fbd47c4
SHA1 7faa67ffae8ca454560499fa8fb0085bf4ab25f1
SHA512 98f39319c332b6c8af47db4e6de43f745687c90a1e3ff6e56512f67388c5441110cca81963ae7965cdbc80d1826c1879bfbc5a1be6a6e398614a2b46a1e2eed2
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzjNqWie+Ue8:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDJ
TLSH
T1F7B2B638D7D99DF6D36781B7C8B2A5911032FF26A1211D1EA85A36010CB3643B5E3DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download