waski | a2b7cd3130df49a1eb4bcb98b5dee18bcf382e46a7b38955686f376ec0cc98eb

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_f404fcc49a132e62049c19b79b5da455_elex_wannacry.exe
Size 22KB
Sample260527-jf7bmsgx3q
SHA256 a2b7cd3130df49a1eb4bcb98b5dee18bcf382e46a7b38955686f376ec0cc98eb
MD5 f404fcc49a132e62049c19b79b5da455
SHA1 f0af71d5f2fe84656980e1762f7a4fe2b4c31e39
SHA512 f797478fd792844410f5db395726e3d246b11a5bf9624b8be228f316bf1f24f3ddea5920fd57dd310b994acc6cb5d94704c22980d62b42933532e7ebc82aeca2
SSDEEP 384:uTQWckBeEd6ml1pcg7F3GiSrI82aGokquJTd:uxckEEd62J7F3GihoBuJTd
TLSH
T16EA252386FD51E72E3BBD7F285F7D2C6A975B0277A035A1E80850B451823F11ADA0E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000000d416-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
988	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_f404fcc49a132e62049c19b79b5da455_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 988	756	2026-05-27_f404fcc49a132e62049c19b79b5da455_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-27_f404fcc49a132e62049c19b79b5da455_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_f404fcc49a132e62049c19b79b5da455_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 22KB
SHA256 8d57b73ab4629d7541c75af3b9e24e9c88b928eeb7d2c4ada4c88ca5a74a89ee
MD5 b3313b38d54e3552b817f92cb24eecfc
SHA1 a1d4d34594d14b49b90837835cb505ab5a266a83
SHA512 a5bcc4f6691457c453bba936c19a63d4343a1e7e8865858f776d6fec9b9323360909a2165cf5e7feb343d3bbad5516c794094d188f6e16400761cdf9ccf6fd60
SSDEEP 384:uTQWckBeEd6ml1pcg7F3GiSrI82aGokquJTS:uxckEEd62J7F3GihoBuJTS
TLSH
T1FFA252386FD51E72E3BBD7F285F7D2C6A975B0277A035A1E80850B451823F11ADA0E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download