189750c402c01e1f06ebc3e9b46e84769581056ef5ce9985c3f847fc6380816c

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_43db2f1c9cde2f0fbb3bf173d81d38a7_elex_wannacry.exe
Size 63KB
Sample260702-2tzstsf181
SHA256 189750c402c01e1f06ebc3e9b46e84769581056ef5ce9985c3f847fc6380816c
MD5 43db2f1c9cde2f0fbb3bf173d81d38a7
SHA1 c5ffe1970306c3b1521436a049e5ce6713c122e5
SHA512 22461dc7431bf18a81fbed380da4f51d68706e6f2165ac2d2c0a554b5f23f4d3dd29adfdbf1c24826b09a2534f4829c2a09ec33786800d71afa6727504364afd
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco253:rmwfKOj1TRf/2SZLO8iJu7I9KKlD253
TLSH
T11E537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2136	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_43db2f1c9cde2f0fbb3bf173d81d38a7_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2136	3864	2026-07-02_43db2f1c9cde2f0fbb3bf173d81d38a7_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_43db2f1c9cde2f0fbb3bf173d81d38a7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_43db2f1c9cde2f0fbb3bf173d81d38a7_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 63KB
SHA256 d9816a401313c240045e6d1f7b383f0b5ded432305079bcd7405d1970d6da243
MD5 f58458fff770e3b912a48516f42b1103
SHA1 abcf4937d7d5794a0795c03857731ec1cb7c9271
SHA512 6415646798447489fb2dee86425a19083b46b28897c7a7f40fd9a31b984c63c81143c4f65bffaf6fb9ef7d396ce631f074e086819d98967c6fd8cff248f47f7b
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25g:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25g
TLSH
T16E537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download