waski | fe1ba1f9c513bdbae25569579e2144380a268a4d973e5aeb97d5d72e705de854

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_043a6a2dde2c800a174b3dda984e2b6b_elex_wannacry.exe
Size 17KB
Sample260708-2ncfcabs2x
SHA256 fe1ba1f9c513bdbae25569579e2144380a268a4d973e5aeb97d5d72e705de854
MD5 043a6a2dde2c800a174b3dda984e2b6b
SHA1 3786d48f161b1c2b522f095ad01218e65952d667
SHA512 d787cfed1431332ad64ad4150d685f7bbe5d662ba8fe10c8059b95fcbf21fbec43fb800a79db0dc3f06e5566231dc227b5d96d23140d9e3e83c23eda159c7945
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFy3nL6/:uTQWckBeEd6ml1pcg7F3GiElpd2Q
TLSH
T1BF82B6356BD55D73E3BBD7B186FBC1C66875702B2B03992E80481B882C33A11DCA0F89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000000730-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
2156	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_043a6a2dde2c800a174b3dda984e2b6b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2156	4988	2026-07-08_043a6a2dde2c800a174b3dda984e2b6b_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-08_043a6a2dde2c800a174b3dda984e2b6b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_043a6a2dde2c800a174b3dda984e2b6b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 18KB
SHA256 fd6f6904a45b97ef9ed24bbb1377c882f133eff4c63ef43260af4d91407f7b35
MD5 56fd57da1d74be0f1c1927e662800cb4
SHA1 a82dabb99d99fd936a7fc635f12a7206f9f78f8c
SHA512 a772276e72f255e57c8b4189bb679a39d796846eebe48ee9035653abf5a6f0f7d86db04cf5ad2cb08468f1e956095c65ffdf3b8fae4064c8c5cde0a1b2bfa9a9
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFy3nL6+:uTQWckBeEd6ml1pcg7F3GiElpd2t
TLSH
T18182A5356BD55D73E3BBD7B196FBC1C66875742B2A03992E80481B882C33A11DCA0F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download