ba42fe6d64d4728ab2784c1463f7bb6a66e7b88b146dc7ff1a6ddc7192bcead1

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_ef4218c56a479512aa53d9ff24de2b84_elex_upatre_wannacry.exe
Size 41KB
Sample260707-2cbpnse171
SHA256 ba42fe6d64d4728ab2784c1463f7bb6a66e7b88b146dc7ff1a6ddc7192bcead1
MD5 ef4218c56a479512aa53d9ff24de2b84
SHA1 32d7ac750074bd8def57d0063bb2328ce043969d
SHA512 b2ae001c4cc8d14c20a3beb23e79b329feef88b7e55c0c312d9e26065c3b66ce66799b2a1422956fa4fa73b3ac1a52a656c8618987d06522f01fce6b86890da2
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHL4/:AC2tUZdHAMEyngXtXO
TLSH
T1FB139A38AED95572E37BDAB5C5F640CAF979BD233902680E508673400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5920	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_ef4218c56a479512aa53d9ff24de2b84_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 5920	1704	2026-07-07_ef4218c56a479512aa53d9ff24de2b84_elex_upatre_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-07_ef4218c56a479512aa53d9ff24de2b84_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_ef4218c56a479512aa53d9ff24de2b84_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 41KB
SHA256 3d5a72f4bd20a0702c05e6efe16575a69879f9a1376e050dcaaedbda3ceb9a1a
MD5 c4537ccbd20b0f0aeed070ca28745f5d
SHA1 7824582bc42cb916e31ca2ac44c9589930493665
SHA512 9d15119d460dba0296bf757a6d7a721a9e28e89fc5a05f19f19bb48fb759eae36089917997b9f1db2fa02a56571b90d4497185ffe111fbbdb04c44134b27d0a3
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHL4s:AC2tUZdHAMEyngXtXJ
TLSH
T1ED139A3CAED95572E37BDAB5C5F640CAF979BD223902680E508633400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download