eb60bae5118b20d7827cfeea31e3b17a546f4ba0ef6804bb58eac5553b2c3fed

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_259ac959f850fadd0ca300377dd97ba9_elex_wannacry.exe
Size 62KB
Sample260602-arg2fsbs6j
SHA256 eb60bae5118b20d7827cfeea31e3b17a546f4ba0ef6804bb58eac5553b2c3fed
MD5 259ac959f850fadd0ca300377dd97ba9
SHA1 565f6aca3b5c1cc89f8806a3cb47bb2b2c3fd69f
SHA512 75fdd2ad54033ad9754f3e31718c8f47740dab9e6f2241e9fb418e8e8edf0b4126de6de5e121d8f4eafe51aab5ca38b991449c3e96b7f10e5ba076e871af99c5
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco4:rmwfKOj1TRf/2SZLO8iJu7I9KKlD4
TLSH
T1AB537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4576	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_259ac959f850fadd0ca300377dd97ba9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4576	4028	2026-06-02_259ac959f850fadd0ca300377dd97ba9_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-02_259ac959f850fadd0ca300377dd97ba9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_259ac959f850fadd0ca300377dd97ba9_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 62KB
SHA256 f68028b62e6364bb01fa508d0afe104ede01e8ad984ce43b3c10c05849763357
MD5 719019875c9608b5d330482adb6245b8
SHA1 29517322e5edc90331b9fcde26f5d740f9ce1db2
SHA512 29ca781c31510d77d5a5ba2f07170c22787c952220f9909a1d5b5976365a7648116de4f877fbacf2a06bbd28cc345dfab1eb214eb704a4979ab7b325acf88087
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcot:rmwfKOj1TRf/2SZLO8iJu7I9KKlDt
TLSH
T103537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download