waski | 170f0b9a473a3bf6d002a9daffbf5cc6aee191a447b9e8b68e2162c7f24e51f0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_48fd6cf61df938a31df81bc7861ddffa_elex_wannacry.exe
Size 28KB
Sample260518-jch5msgz7s
SHA256 170f0b9a473a3bf6d002a9daffbf5cc6aee191a447b9e8b68e2162c7f24e51f0
MD5 48fd6cf61df938a31df81bc7861ddffa
SHA1 1638372ecee74e9cc7da2c019cabdc5f5588759b
SHA512 0af11d81b44c218612934b9a2fb9a434ab757d24421660f189f35d6e12f2c277b8ea98c78e8a14b8a1e0a1e82ac2db9249dfe8e601306826f4ad222a52b0289f
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsIc:uTKWckBeEd6ml1pcg7eMUUz61
TLSH
T1ACD2B6356BD45D73E3BBD7B186FBC1C5A975702B3A03992E84491B882C23A11DCA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000028ec9-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
4416	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_48fd6cf61df938a31df81bc7861ddffa_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4416	4304	2026-05-18_48fd6cf61df938a31df81bc7861ddffa_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-18_48fd6cf61df938a31df81bc7861ddffa_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_48fd6cf61df938a31df81bc7861ddffa_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 29KB
SHA256 c8b8baa8c67d61a55d7c088f5ab045a520ce8ec7b4e9cbaa2097d7884b2eab33
MD5 7fa9b135a125b47eb38cc1cd0d2cb200
SHA1 59919641d77ffe00f0ee4d6dc697e8e68af98e73
SHA512 21026f5478096d828d01c6fe1d866b3c50e4e6fe58d2ad9c2de8969bc11f6b6ab05096ebe2b33500af152d9ee2eac167a3123f9ab29ffd21f76e5a6cc6c0dcc1
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsIe:uTKWckBeEd6ml1pcg7eMUUz67
TLSH
T1E3D2A4356BD45D73E3BBD7B186FBC1C5A975702B3A03992E84491B882C23A11DCA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download