8dde6444a8b8d12b06e069ddf9f0aed04d48aa36eace9ed47aef5d0aa675aec8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_533a4b3d0bdfe6b07f07ecc85de0c401_elex_wannacry.exe
Size 23KB
Sample260517-1csgrac15t
SHA256 8dde6444a8b8d12b06e069ddf9f0aed04d48aa36eace9ed47aef5d0aa675aec8
MD5 533a4b3d0bdfe6b07f07ecc85de0c401
SHA1 e950e2bb834aa15c189510ab5ff5ecf558500304
SHA512 5c5287c781fc41343411d69f0cb0c83558349bb31d7967897ff2c5854fb8ef45244d09c7f1e3f25f7020ad9d5892212d9a9b669cb7ace2afdc5bd14233cd75e7
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzjNqWie+Uw:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDi
TLSH
T1C5B2B538D7D99DF2D36385B7C8B2A5911032FF2291211D1EA85A36010CB3A43A5E3DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2196	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_533a4b3d0bdfe6b07f07ecc85de0c401_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2196	2076	2026-05-17_533a4b3d0bdfe6b07f07ecc85de0c401_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-17_533a4b3d0bdfe6b07f07ecc85de0c401_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_533a4b3d0bdfe6b07f07ecc85de0c401_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 23KB
SHA256 5e02647e2f060f997dc3f51903c2d9ac71e5275538e187807acc5f42e87a01ad
MD5 8ab3a2909e2abaf7b1e2117f96518efd
SHA1 cbf90e3c8ef3f7e9bc50a9c759935de209383d87
SHA512 4a0a6285013099d612353406cd89be770890edbb2b79cdb488298fb56773612032841bd783ad94a806722f0e6c59507da4485921bf484b0a283daef04b7cabe1
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzjNqWie+UEf:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDQ
TLSH
T127B2B638D7D95DF2D36785B7C8B2A5921432FF2291211D1EA85A36010CB3B43A5E3DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download