c702120fc6daee36d6f453554d8d06837a2e7008e58fcb01718a24ad81d79c5d

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_7ee6047137e555d22a2cd3f0a0ff26eb_elex_wannacry.exe
Size 59KB
Sample260707-mc5v7afx2v
SHA256 c702120fc6daee36d6f453554d8d06837a2e7008e58fcb01718a24ad81d79c5d
MD5 7ee6047137e555d22a2cd3f0a0ff26eb
SHA1 d9c8782abc0f768c16aaf5529c8fbec0da25cf83
SHA512 de67503d1ec478ad4f0f7743598d697664dbb1f8d78c4f92c229c8c92c68cd97e795a8fd8c16184ece21e39ae377f2bce3afa88e6048f4c34945b476f40cf46d
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKB4:d2jXRrs9sINeZEtejlIkoLN127BFVn29
TLSH
T18253BB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2960	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_7ee6047137e555d22a2cd3f0a0ff26eb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2960	3012	2026-07-07_7ee6047137e555d22a2cd3f0a0ff26eb_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-07_7ee6047137e555d22a2cd3f0a0ff26eb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_7ee6047137e555d22a2cd3f0a0ff26eb_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 59KB
SHA256 4ae7ea9b7925d209d27328ff983eb74803613c80d82f04c1b0901af0d3d18ade
MD5 cbdde9e5eb2c4de3b2e55242a36c1df0
SHA1 94cacb4bba2c0b7566dbacc3367fbca2c33184c4
SHA512 2c19c816a06dabec6c90c8dd71b0dab8a03f5b072c1d74497567b6c6f56da09016dfef3c4b7ee9427fe267778e8d797755ec12fadca6bcdb48313ee2fc88fc81
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKBg:d2jXRrs9sINeZEtejlIkoLN127BFVn21
TLSH
T14553BB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download