fae5674d30b8e4210521980b63da8af8dd184ce4167f794f0d8af49a6973416a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9f1fc0ab8f06b94a0356942811ec73f8_elex_wannacry.exe
Size 20KB
Sample260629-e6te9ac18y
SHA256 fae5674d30b8e4210521980b63da8af8dd184ce4167f794f0d8af49a6973416a
MD5 9f1fc0ab8f06b94a0356942811ec73f8
SHA1 dd20aca57c06adbe3c29616a4ee223beb331c358
SHA512 2b774267b6969bace0fe13658de8bc5edd73f504377a062a6eab38bb3890e39a09df7833d269c2cc1c6b35fed3d64da2e865f5124150e105a0482ced61c8ea47
SSDEEP 384:6YRpfgBcDZG3snl1YgToFYs7KdyPIP1v0oB:6YfoKSs71TXaK+ItP
TLSH
T108A25BA27FF80DE1D3BB8F38193392968D7970216817691DD580A1CFCD6F582CA6C792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_9f1fc0ab8f06b94a0356942811ec73f8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 1992	5824	2026-06-27_9f1fc0ab8f06b94a0356942811ec73f8_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9f1fc0ab8f06b94a0356942811ec73f8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9f1fc0ab8f06b94a0356942811ec73f8_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 21KB
SHA256 9dfb1f6a369826bcafe113af90af63d77f0ede84a9977710ef497f477eec652c
MD5 369985880ab64a7a82d56feb4d6e3fa5
SHA1 e686866301e6b11145d1f9c2c06587e51ba9eafe
SHA512 1c15b75bd1930bdfb3f48783c1350e70f483486eaddaa5a8109833bdc1e3c0fd2304a9866df86d0a6f8990f2a2c2c70216e739f7cb6bbc4e6595872c7063603e
SSDEEP 384:6YRpfgBcDZG3snl1YgToFYs7KdyPIP1v0on:6YfoKSs71TXaK+Itp
TLSH
T17BA25BA23FFC0DE1D3BB8F38197392964D7870216817691DD580A2CF8D6F582CA6C795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-18-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5824-8-0x0000000000400000-0x0000000000409000-memory.dmp