d06274002a66c05258dc54acddc69309940fb083e8e36a8b3e55a09d8eac8ddf

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_71f6b4a3f9824c1da91a8e605c643e7b_elex_wannacry.exe
Size 58KB
Sample260629-sd63jags6y
SHA256 d06274002a66c05258dc54acddc69309940fb083e8e36a8b3e55a09d8eac8ddf
MD5 71f6b4a3f9824c1da91a8e605c643e7b
SHA1 aef3859c576b5ad21e91fd41485c750f3e511643
SHA512 00a1341b7c60e15aa3e5e79067c325bc3ffbb251a8ae97234a3181b752539f44e064f4e37b16c846b268dc7b029ddce932d913b294bbd104ac9db67c4c25dd1f
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBS:d2jXRrs9sINeZEtejlIkoLN127BFVn2j
TLSH
T14843BB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6052	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_71f6b4a3f9824c1da91a8e605c643e7b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 6052	2824	2026-06-26_71f6b4a3f9824c1da91a8e605c643e7b_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-26_71f6b4a3f9824c1da91a8e605c643e7b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_71f6b4a3f9824c1da91a8e605c643e7b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 59KB
SHA256 d624e33a0fcccd07f57cc18a6512cb85655de8ed1842ed8a2e61bed879a40999
MD5 ef823d906fe2173d1dbf4934cd14489a
SHA1 b1eb6e946b195ca97ef60dae2cde34def3444e18
SHA512 22f9f4060a8f2a6e27bee578cc2172bf43997f4f3ceaf01a35048ca79be5e32ab44a4a00caafc98ee46432a63f1d8098f6d2154efe4df89be01ddb0e9df61683
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBX:d2jXRrs9sINeZEtejlIkoLN127BFVn2e
TLSH
T1AB43BB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download