a5dd5535d4a7412ad2f3804ee0864f6eaf17f7bf6782d2d230f335a9b0bf6061

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_8ed492ebc6844d90ea8bb6263ce9e774_elex_upatre_wannacry.exe
Size 79KB
Sample260507-erv1jaex7x
SHA256 a5dd5535d4a7412ad2f3804ee0864f6eaf17f7bf6782d2d230f335a9b0bf6061
MD5 8ed492ebc6844d90ea8bb6263ce9e774
SHA1 37d04073355e6a60b904f942b2daab65153c50c4
SHA512 6e1cb5104308af5b2c77b718ac249ada029c2a1d2475fc0e971f9ae3f1cab12e26667ceeebf50381429f9983423b9a96a345088a480aed19e6db8462de31ced9
SSDEEP 768:EsJhM/47dTkc8jmiG/7H1SE3KGdA6jVS2bnKHtIGA8/nVNEcoX7zPjqEJ2x0NXmq:EAA4R43e/7VOEjs2FRP2EJySmq
TLSH
T12283473CAEE85672D3B7CAB586F651C6F971B8223D01580E609A13480D33F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	2026-05-07_8ed492ebc6844d90ea8bb6263ce9e774_elex_upatre_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4440	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_8ed492ebc6844d90ea8bb6263ce9e774_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4440	4724	2026-05-07_8ed492ebc6844d90ea8bb6263ce9e774_elex_upatre_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-07_8ed492ebc6844d90ea8bb6263ce9e774_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_8ed492ebc6844d90ea8bb6263ce9e774_elex_upatre_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 79KB
SHA256 4ecb1c5d6effda50f2fe8847fad982492a4ab31bb889654c5d2e43ad66413997
MD5 3529f41871d19ec98ddd08f88d93b157
SHA1 6edc01dcb96b4aea6ef2da52e08e948455061f22
SHA512 5504f28ab98eb06b90b9f09f56b63aead510ea355a28ef56ffd82d08d013a9c09bde46aada1902edff7ddaf81790a18664c1adea8f10e2da89d892d39db6b8f0
SSDEEP 768:EsJhM/47dTkc8jmiG/7H1SE3KGdA6jVS2bnKHtIGA8/nVNEcoX7zPjqEJ2x0NXmS:EAA4R43e/7VOEjs2FRP2EJySmS
TLSH
T17A83473CAEE85672D3B7CAB586F651C6F971B8223D01580E609A13480D33F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4440-9-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4724-0-0x0000000000403000-0x0000000000404000-memory.dmp