06679fc5cb5016cc3d070b64c8b6f722dc2206b20c01aa3798ea2e30d8cc346c

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_931ec0682460bb4633c97c86757b5c31_elex_wannacry.exe
Size 62KB
Sample260629-flw63sdv7x
SHA256 06679fc5cb5016cc3d070b64c8b6f722dc2206b20c01aa3798ea2e30d8cc346c
MD5 931ec0682460bb4633c97c86757b5c31
SHA1 093c78129855535be2a15588f213f7afaa33f085
SHA512 cf922009f7210e521c143b6fbe95770bd759ff6a8daab3c8bc994925cbf7484cb735a3d0d487842528636c8c27b00de7b99f1183fa3714660011c8650e061afa
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcoS:rmwfKOj1TRf/2SZLO8iJu7I9KKlDS
TLSH
T1C6537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3784	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_931ec0682460bb4633c97c86757b5c31_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 7052 wrote to memory of 3784	7052	2026-06-27_931ec0682460bb4633c97c86757b5c31_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_931ec0682460bb4633c97c86757b5c31_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_931ec0682460bb4633c97c86757b5c31_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7052
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 62KB
SHA256 9402fd04726bba1784b464ef300280eb2110fa14a6028e2f7259bdef9e6f2a5e
MD5 2102cfc622c04e217ba8ec16e681734f
SHA1 27efb968b4cc1dbe516d0049bb93bd338b20edbd
SHA512 1f089ae5bd72d565c372ce8dc41936c240c98fbee22deae934da500e9c0b94aa0ed176184c0c24290ee3b5695c919ecf133853f2d0dd7ac2732f6becacb1a633
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco1:rmwfKOj1TRf/2SZLO8iJu7I9KKlD1
TLSH
T196537A3CAED51572E37BDAB6C6F251C6F975BC223D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download