126ecd2da9c8c40cfd6aae0f5d6de120b64aa931a893b31248dcb30f36030d9b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_a39cb1b12ca39fed078da0d51d634b65_elex_wannacry.exe
Size 38KB
Sample260516-rtms6ah17m
SHA256 126ecd2da9c8c40cfd6aae0f5d6de120b64aa931a893b31248dcb30f36030d9b
MD5 a39cb1b12ca39fed078da0d51d634b65
SHA1 3a8bbb28dce5372793c6def510ce64cf23f5864b
SHA512 d635cfe542201e89ba5a923da182d13b49bc336cc9d76d57aa117b411051cc6cb9a25f4ab2028e1b23c732469400d40eeeaf58c2d2d0e39688a877d45a2322e4
SSDEEP 768:MLpaPBfujHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+IusJe5+UL0:z2jXRrs9sINeZEtejlIkoLN127BFVn2G
TLSH
T1CD035434BFC519E5E37795B3F9F695C2A536B9627802990C40522F8508F3B52EDA0E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4376	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_a39cb1b12ca39fed078da0d51d634b65_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4376	2924	2026-05-16_a39cb1b12ca39fed078da0d51d634b65_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-16_a39cb1b12ca39fed078da0d51d634b65_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_a39cb1b12ca39fed078da0d51d634b65_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 39KB
SHA256 99b716795eb91257eba3c03fbf6edb5689e2d1c1d44b839b02e611936ffd7bdf
MD5 0a8ae70be3f2c591f2099feb1d32f0c1
SHA1 03ca0097ae73867111f2dadff391dc1e3da126fb
SHA512 1a99dd682fdafaa43e96470493a07f3df52e678edf44738536435367944299c2792ee14f0e7ca2ad040146d1d3b10b8b45075d85d44ad24f5e55bad6098d22ad
SSDEEP 768:MLpaPBfujHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+IusJe5+ULXP:z2jXRrs9sINeZEtejlIkoLN127BFVn2h
TLSH
T16D035434BFC519E5E37795B3F9F695C2A536B9627802990C40522F8508F3B52EDA0E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download