1a47865c09cef15eeaa533d7bb43de59dbb38f3c8ddefb01ef69d85ea50def11

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_af0aaa759d9daeb09931774941bbafb4_elex_wannacry.exe
Size 58KB
Sample260524-2ndcmsbz7x
SHA256 1a47865c09cef15eeaa533d7bb43de59dbb38f3c8ddefb01ef69d85ea50def11
MD5 af0aaa759d9daeb09931774941bbafb4
SHA1 7fae6825bbb4ae93ecd7617164efa3ee26feb7a4
SHA512 af4c0c2ff31f9c9f83e8541d3c6b5156a84ea3ba671f7da302ab25d7edeab9884d1f590a23ec57bd5225594ee84f15612de3609a6dd10658642b2100299c1dbc
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBef:d2jXRrs9sINeZEtejlIkoLN127BFVn2P
TLSH
T11543CB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-24_af0aaa759d9daeb09931774941bbafb4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2036	4380	2026-05-24_af0aaa759d9daeb09931774941bbafb4_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-24_af0aaa759d9daeb09931774941bbafb4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_af0aaa759d9daeb09931774941bbafb4_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 58KB
SHA256 935fa75a1202f9cdb419c4d24eaff24d87841cb7b99ac3e52ca54ccfeb751ce5
MD5 ce2e17746138aa920090bc867255f274
SHA1 c48efc558cfdaa96cec283fe80ed80366b5d2157
SHA512 51019d54153bee4deb6a7fbe1cbea7f7508c3e6eab95cee2f789937d6330cbc65cb69a4b83986d5d90db0afdd17b617b718addfd06baa36c05ad618b4da4f7bc
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBeN:d2jXRrs9sINeZEtejlIkoLN127BFVn2d
TLSH
T13F43CB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download