e10fe7566f4e7e2f1638fe032bffb3d545860a939acc09b1a1abc3ffc03bc6e6

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_47f08f36fa444a7d6aa930202a417534_elex_wannacry.exe
Size 59KB
Sample260524-zzy3daa171
SHA256 e10fe7566f4e7e2f1638fe032bffb3d545860a939acc09b1a1abc3ffc03bc6e6
MD5 47f08f36fa444a7d6aa930202a417534
SHA1 f3d238b7a46908f4c720b10b5cabb483d98b72ad
SHA512 0748c325e4bbbdd65d5e5592e6db857e48daf7162a16f9aa8bbc4fce6338b2f2e705e9e23868e4e7d6ba475815e5a312661c587958f9c5669a61e8b722682d8e
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAVw:QbjXRrs9sINeZEtejlIkoLN127BFVn26
TLSH
T19253BF38AFD515B2E37BDAB7E9F651C6B975B4233C025C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1700	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-24_47f08f36fa444a7d6aa930202a417534_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1700	2380	2026-05-24_47f08f36fa444a7d6aa930202a417534_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-24_47f08f36fa444a7d6aa930202a417534_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_47f08f36fa444a7d6aa930202a417534_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 59KB
SHA256 15f2e7d9da40ff6e208a21138833652605fc1b525fc6255db9489a7284ced5ee
MD5 661f6ca6095c57ed4af2ee1dad237bf2
SHA1 1314f741d54f207b1d48ee5094b89b93fa7d78af
SHA512 30a176736e47d4022cc4cb0a12327f556acca878e603a79e975c7be69485b7da532b94ac3c1f64bae3dd40f982dff2ebbf939703ad4cd783bce7c276fe140b2b
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAVr:QbjXRrs9sINeZEtejlIkoLN127BFVn21
TLSH
T18553BF38AFD515B2E37BDAB7E9F651C6B975B4233C026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download