cd8c63b48de7c68d2bc18fbbbd2d94a130b11f7f5c98292129a10cb988577044

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-08_5870e18ac3561ef6f9059803fd26d892_elex_wannacry.exe
Size 61KB
Sample260508-t1betaet5p
SHA256 cd8c63b48de7c68d2bc18fbbbd2d94a130b11f7f5c98292129a10cb988577044
MD5 5870e18ac3561ef6f9059803fd26d892
SHA1 dbf1a85e589e4f1be44f459d00bb6f9a41c4c8b8
SHA512 218550dfc146d17cc9ec268e355fd88819622202c37ffb6c372f67fb832dad74c7d7400a63c7314f4744bb1380fafbe0fd66c9096fcdb292bdcbc457e5dfd722
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcox:rmwfKOj1TRf/2SZLO8iJu7I9KKlDx
TLSH
T1DF53793CAED51572E37BDAB6C6F251CAF975BC223D01680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2400	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-08_5870e18ac3561ef6f9059803fd26d892_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2400	1776	2026-05-08_5870e18ac3561ef6f9059803fd26d892_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-08_5870e18ac3561ef6f9059803fd26d892_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-08_5870e18ac3561ef6f9059803fd26d892_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 61KB
SHA256 3a795d4e56980d9ad0ecbc8e3fe3018fbdae0250dc6443f1c4af26ad706af9cc
MD5 a67489def4573c3b873d59f453d9255c
SHA1 c2a23b638fff97cb7aa00fc91ed1f98fefa70018
SHA512 ea51e8ffda5800f28fa856a518a067dd66897bac814ce76cae83f89477a94933a9925b61d34628cd6674536c5d442673a886e499423008e8f9e56f6465e159d1
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcot:rmwfKOj1TRf/2SZLO8iJu7I9KKlDt
TLSH
T1B953793CAED51572E37BDAB6C6F251CAF975BC223D01680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download