af6fff6ceaa2213119214b5f466d633145a3b9fb4cd50dc2af95cb50ed0c37a1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/05/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_7633206794c87e1564688e1dbcbbe1ab_elex_wannacry.exe
Size 20KB
Sample260530-ftprzagt5l
SHA256 af6fff6ceaa2213119214b5f466d633145a3b9fb4cd50dc2af95cb50ed0c37a1
MD5 7633206794c87e1564688e1dbcbbe1ab
SHA1 e46f4111b65352d355cea8bc29f4f86b2001414f
SHA512 300d2d50d89b092ed9c4ff277197f7809e7f4e5096ee34419b1f7735af30edf3226eee82df1e4e55a800e6955b98cfe0ff611097970c9b4379daf06c18af401b
SSDEEP 384:6YRpfgBcDZG3snl1YgToFYs7KdyPIP1v0y:6YfoKSs71TXaK+Itl
TLSH
T186A24BA22FFC0DE1C3BB8F381833929A8D75B1215817591DE580A18FCD6F592CA6C795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-05-30_7633206794c87e1564688e1dbcbbe1ab_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3204	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_7633206794c87e1564688e1dbcbbe1ab_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 3204	3276	2026-05-30_7633206794c87e1564688e1dbcbbe1ab_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-30_7633206794c87e1564688e1dbcbbe1ab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_7633206794c87e1564688e1dbcbbe1ab_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 20KB
SHA256 125084ab748c84dbd3d4ed8c62175a9e44069727b41708b512a1f360e53116fd
MD5 3d3a98a8f0b639b751f070473a671f53
SHA1 533bdaf62f1193640a91d8d4b39b740fba9add78
SHA512 b057dcdfba5fb7cdaa926b3368f2fe9227e1ddd2dfc444198c700b2731eccfd71a467aaa85f5b0ef8d5ed5ea16f7d37cc48476a0dbb802e7531e84952144c6fa
SSDEEP 384:6YRpfgBcDZG3snl1YgToFYs7KdyPIP1v04:6YfoKSs71TXaK+Itb
TLSH
T15AA24AA23FFC0DE1C3BB8F381833929A8D74B1216817581DD580A28FCD6F592CA6C795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-9-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3276-8-0x0000000000400000-0x0000000000409000-memory.dmp