487094e63c09d1b21860794c4ad92acefcb7b7573070779cbf99cd53801c32b2

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_8bee4075e428e61ebd25e9a380a58a6c_elex_wannacry.exe
Size 64KB
Sample260718-mzhdeact2v
SHA256 487094e63c09d1b21860794c4ad92acefcb7b7573070779cbf99cd53801c32b2
MD5 8bee4075e428e61ebd25e9a380a58a6c
SHA1 316826e7c2db68782aea88f908b6207832ab4fea
SHA512 63a1d4960623c07431f81ac9ac649b4ff623dbc2936351764722656a636726c56318a6fc9f158c4e8e945a3b68c8e72bad69a98adcc42c8895e120f78c511969
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25c:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25c
TLSH
T1F2537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4404	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_8bee4075e428e61ebd25e9a380a58a6c_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4404	4828	2026-07-18_8bee4075e428e61ebd25e9a380a58a6c_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_8bee4075e428e61ebd25e9a380a58a6c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_8bee4075e428e61ebd25e9a380a58a6c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 64KB
SHA256 39a7f30ddcf4004dc7cbb3db5a219086d4cb98f943b2afdf71f05387c9bbcd41
MD5 4bf84d78836c92909912ec6c7f0a7b7a
SHA1 9936a7a8954546d514397261e82db51512ce7ca4
SHA512 70c525e21b68ca87748f3dd9e94f05327258641847588d49d66d7f11032f7c08d67f1f6f5259d15d17e24699d5e7320f099f48433180457f37bf679a798f0e43
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25X:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25X
TLSH
T147537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download