waski | dc12a66104c0415b8e8e043e086061c5e98b19b16b8a3ab9b34e343bdbf3257f

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_37b2c9dd14fc5458bf06a89ce173b647_elex_wannacry.exe
Size 21KB
Sample260712-lpn8jahx21
SHA256 dc12a66104c0415b8e8e043e086061c5e98b19b16b8a3ab9b34e343bdbf3257f
MD5 37b2c9dd14fc5458bf06a89ce173b647
SHA1 98e39c260034ee435a6c0b08b56a8eac44a66f31
SHA512 5bbd0a9c1cc8301d6bf224ece950c7b6fbdd967b889d5ba49a93a660fa1d419a45e9c45b2c6dac181063abb98f93ed463e7b246a234c1f357a1fc29efff4cdd9
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGimebgrJWlkGe:uTQWckBeEd6ml1pcg7F3GiSrI8ra8
TLSH
T197A241346FD51EB2E3BBDBF285F7D2C6A975B0367A035A1E80450B841823A11DDA0E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001300000001c4ec-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
3872	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_37b2c9dd14fc5458bf06a89ce173b647_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3872	3584	2026-07-12_37b2c9dd14fc5458bf06a89ce173b647_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-12_37b2c9dd14fc5458bf06a89ce173b647_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_37b2c9dd14fc5458bf06a89ce173b647_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 21KB
SHA256 55a6d3eb53dc0efe6257d872cf52ba1055ce73d3ef051990546f0a285dd66296
MD5 002fa18ca57c6cbb6b38734890b465f0
SHA1 cb31591720e22d4ac519e0f58d95f50bca66fe11
SHA512 c595452471967c9eb0698d7f39a1ae6507a2d88b55dd10bee95bdf0d51ec2aae37dd2a39db914618cdd08576279054d4a4b899b594cfe69794d36923841f5c9f
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGimebgrJWlkGG:uTQWckBeEd6ml1pcg7F3GiSrI8raE
TLSH
T179A251346FD51EB2E3BBDBF286F7D2C6A875B4367A03591E80450B841823A11DDA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download