24801d08993d01d73dd95c8b5a0f47ad404d1bcfdbbe14b5776a8de3f2204ed9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_f244760ed844ebde0af7a36830d54d00_elex_wannacry.exe
Size 58KB
Sample260527-ej5vrsht4y
SHA256 24801d08993d01d73dd95c8b5a0f47ad404d1bcfdbbe14b5776a8de3f2204ed9
MD5 f244760ed844ebde0af7a36830d54d00
SHA1 521663d8f3573a79760075e1cfc9d12fdae81696
SHA512 b452cc88c5fdc4c09c16ed6784c5e99a6071fabbf4a0c336c3c6d52e837017a524f0c043667b2113ef59549eef7b0b8aaf3a2e949100e48afea430c9c5b4e36e
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBi:d2jXRrs9sINeZEtejlIkoLN127BFVn27
TLSH
T1EA43BB38AFC515F2E377D6B7E9F695C6B936B5233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5656	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_f244760ed844ebde0af7a36830d54d00_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5656	4604	2026-05-27_f244760ed844ebde0af7a36830d54d00_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-27_f244760ed844ebde0af7a36830d54d00_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_f244760ed844ebde0af7a36830d54d00_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 58KB
SHA256 5e70ed46ad1690a1cf80bea2d32be814ccf14e1055ee3a6dd383ef40b92d2fe4
MD5 c81ad4f4ce4eaf2ae169848945a6c413
SHA1 c0c7cd1586fccf355a83fcbe7d41877801601559
SHA512 1194286039fb87d3e2ee19e4f78117ec62c1873c3b0654b0aecdc929c909109eda1f8180a428ec9fc38819609faa583f84a5ab6392c5062c1015d75f0f67d519
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBYv:d2jXRrs9sINeZEtejlIkoLN127BFVn2f
TLSH
T1F743BB38AFC515F2E377D6B7E9F695C6B936B5233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download