1e122b10e2f8b264fbacd9cd0769966ccab93de729d2c17d7962cd352d3b06a2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_944cea9ee177c9333ae090e1fde7fa7e_elex_wannacry.exe
Size 16KB
Sample260601-e5ssbsct5z
SHA256 1e122b10e2f8b264fbacd9cd0769966ccab93de729d2c17d7962cd352d3b06a2
MD5 944cea9ee177c9333ae090e1fde7fa7e
SHA1 3c3f1b78060d5a8a160f69a15dbdab7ff68e91e8
SHA512 cfb45dbdbf5551c321d848698bae1878c81b4fa4c3b6bf7ed4ed5791a47b71068a9452a24b5164569f703c6e284e27f8d9d7ba798bf49bcf1da2b7ecce592f0e
SSDEEP 192:naIuVoh8tbeq6kbkxKoPIyUMoFl1oynfJP2Oh+AOQOBJbZBEW1QyJ/G/kQcVnT:naIAaIbL6kbkxRIyel11RlPOBJrXXJ/R
TLSH
T10572C5266FE10976E377897496FB64CAA57874227D039D0C945063888C23B62FD30F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4992	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_944cea9ee177c9333ae090e1fde7fa7e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4992	3248	2026-06-01_944cea9ee177c9333ae090e1fde7fa7e_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-01_944cea9ee177c9333ae090e1fde7fa7e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_944cea9ee177c9333ae090e1fde7fa7e_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 16KB
SHA256 84fa98bfe850551d74b35b4a8b889ff015d4c99114795cad9ce658020772203d
MD5 2d7b33f70455326203b49b5e3914c9cf
SHA1 43f293b5f68b488e116bc0ee3cbcb37bb80e28de
SHA512 fa1b85701a68cf312ec0ad8daad92aec0c4c999f29803dcf8d328190556a50e397480db85800a112d33f7cc5428553435934836b2fc6a31caf391e1d775dd83b
SSDEEP 192:naIuVoh8tbeq6kbkxKoPIyUMoFl1oynfJP2Oh+AOQOBJbZBEW1QyJ/G/kQcVn/:naIAaIbL6kbkxRIyel11RlPOBJrXXJ/9
TLSH
T1DF72B52A6FE10976E377897496FB65CAA57874227D039D0C945063888C23B62FD30F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download