236f6ef15249897fa47912e690ec81c782cf70f453c9d1c6d6ef36c442b92b0d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_5cc9d0ef8812d4e0f47914c482304fa1_elex_wannacry.exe
Size 31KB
Sample260527-e5vlxse19n
SHA256 236f6ef15249897fa47912e690ec81c782cf70f453c9d1c6d6ef36c442b92b0d
MD5 5cc9d0ef8812d4e0f47914c482304fa1
SHA1 e475c20ee5d1079ea935cd71a79ccdc3bb0366ab
SHA512 18c314627d86818a90b7245b85de6f879b60bd95ec99a838c84387c99b63c48add827fa05248e221fccbb30652ed4901fbe62b44a4d82e4fb6c7f12979530f82
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pLf:Kz2u4LJjBaECkLSi7xsYhaKDVisf
TLSH
T1B2E21E38DFD959B2E377D6B6C9F2A5C2A871BE2275111C0D548637000C73B43A9E2E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-05-27_5cc9d0ef8812d4e0f47914c482304fa1_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3944	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_5cc9d0ef8812d4e0f47914c482304fa1_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 3944	884	2026-05-27_5cc9d0ef8812d4e0f47914c482304fa1_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-05-27_5cc9d0ef8812d4e0f47914c482304fa1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_5cc9d0ef8812d4e0f47914c482304fa1_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 31KB
SHA256 864450828e0f2657c7a0216df81c8bdecc4b7589f21c142e8728d21b0b0069e4
MD5 c7e29fa35e53340179398680185bab2f
SHA1 313ceefab143a5921830130eedf6a9d3b56cc9ee
SHA512 2d9db5befca7e9cd9213d02a09646aad021bef4cebacdcdeea579c6e504257c2941ae419e84948dc5999e069f0325225c314fb0c0f8da8b6a93cd549598fc6c1
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pLv:Kz2u4LJjBaECkLSi7xsYhaKDVisv
TLSH
T1A5E21D38DFD959B2E377D6B6C9F2A5C2A871BE2275111C0D548637000C73B43A9E2E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download