d2a05de10e0629e4f129fd3b1ee2387bd2093c99b5ba88aa58853ab8b483fa1a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_2825414a7a34096f6bea8a875db02460_elex_wannacry.exe
Size 19KB
Sample260507-jfamnsc12n
SHA256 d2a05de10e0629e4f129fd3b1ee2387bd2093c99b5ba88aa58853ab8b483fa1a
MD5 2825414a7a34096f6bea8a875db02460
SHA1 f7ad765e0301cab147c533b9d0840cfb3a71cbad
SHA512 6763848ad8fc68f376cabd71f69e485f4810b1e33e7130dc9982267a5531d53e9ab0dbf17989c2dee5c0db96be98dc40bd23c506e8289354c6e9cbadb2073808
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFyHOcC9:1NIlcanKw9hQ98
TLSH
T1D69274396FDA0EB2D377DAB289F7A2C6A931B4237D03190D809D07059C13B63AD91E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	ieupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_2825414a7a34096f6bea8a875db02460_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1724	4240	2026-05-07_2825414a7a34096f6bea8a875db02460_elex_wannacry.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-07_2825414a7a34096f6bea8a875db02460_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_2825414a7a34096f6bea8a875db02460_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ieupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
Size 19KB
SHA256 ba63fe492c22fb5996917ab26eff8d7fbffc9bd987ac4305b2cb6c8652431a7e
MD5 da5c4f07bb346bb22faf07dd14f1b602
SHA1 83edac6cada74dc543c2372c9c84b2fd2ebf8b25
SHA512 53bc0420f65e81f4e8ba8f656053069e1be0271a38a7c9a4d69c4e44520c720d953b169e030aa10eef5c9677b949ded605fbcdb0c1bedc48ba649e9e4bd21e16
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFyHOcCf:1NIlcanKw9hQ96
TLSH
T1999264396FDA0EB2D377DAB689F7A2C6A931B4237D03190D809D07058C13B63AD91E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download