dcc0b31d023151a3bb5816a26f9bee56423eeb2f7a16d1eac6284f3bc3e8f843

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_c228543c9b6d4aff4cf36506ed49877c_elex_wannacry.exe
Size 61KB
Sample260529-shrteaet2s
SHA256 dcc0b31d023151a3bb5816a26f9bee56423eeb2f7a16d1eac6284f3bc3e8f843
MD5 c228543c9b6d4aff4cf36506ed49877c
SHA1 a50b36884b2e2c22fc1097c1568c1a362b050185
SHA512 ee1d5aad3af7013415848f1bc2e01035e565aff66428eb3e43a25747d9245a1bdaa6c1019be55aea4481578b839d969ae2bf316ff3766a6c68bc24892a29f77b
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcox:rmwfKOj1TRf/2SZLO8iJu7I9KKlDx
TLSH
T1ED536A3CAED51572E37BDAB6C6F251C6F975BC223D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4736	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_c228543c9b6d4aff4cf36506ed49877c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 4736	5396	2026-05-29_c228543c9b6d4aff4cf36506ed49877c_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-29_c228543c9b6d4aff4cf36506ed49877c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_c228543c9b6d4aff4cf36506ed49877c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 61KB
SHA256 346b57e5d1402d4ace554758e79df35e38f292029a3d8a3432f078d4957af2c9
MD5 2f09a201efc3fe428c4ad8c38afaa190
SHA1 b781ee407652a96901da06e8f254a476e6ecfb09
SHA512 5d1be7360bd9905adedeb892dc153169d851f314299bfbc38666c257f5e305bd4f6747868d5d51d4f75b9b98cd79ac3aa049ddf8919361328125f4491f1ff641
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcoR:rmwfKOj1TRf/2SZLO8iJu7I9KKlDR
TLSH
T18C537A3CAED51572E37BDAB6C6F251C6F975BC223D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download