waski | b9528591b87b9f4c13d1a6b0f650a769601209fdc384c0f5bb5123a89ce90d4b

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_674d4265449006a81d15b79cd8e0cf4a_elex_wannacry.exe
Size 21KB
Sample260720-bry6eabt7q
SHA256 b9528591b87b9f4c13d1a6b0f650a769601209fdc384c0f5bb5123a89ce90d4b
MD5 674d4265449006a81d15b79cd8e0cf4a
SHA1 09dd93f080b196b796dea55cab2fb729a63e378a
SHA512 a96f486b6644d80374322115cb468dde38015fd28634139e53d021b95971584d498b1817c238b027c431c1baf106de73d0c2138aeb321d2b3a49941ca2e8b48c
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGimebgrJWlkG/:uTQWckBeEd6ml1pcg7F3GiSrI8ra4i
TLSH
T192A252346FD51EB2E3BBDBF285F7D2C6A975B0367A035A1E80450B841823A11DDA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000001138e-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
5696	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_674d4265449006a81d15b79cd8e0cf4a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5696	4992	2026-07-19_674d4265449006a81d15b79cd8e0cf4a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_674d4265449006a81d15b79cd8e0cf4a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_674d4265449006a81d15b79cd8e0cf4a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 21KB
SHA256 012e13009370eaa76929548a1baee042032a7441f274df907d20e0249a8de127
MD5 e6462c185e1694e9314b9ab37e218293
SHA1 7576a0cec30711e490972b690e5e67d96987f6e8
SHA512 24e03211707d79145afc4a9123bb6837b472bf34f86ea72f006dc9d5ae4b29a4ee2aa64dce4c4bc4e97fffb59f5a7f0203ab3227f64f83f79d1548808615fbf5
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGimebgrJWlkGd:uTQWckBeEd6ml1pcg7F3GiSrI8ra4U
TLSH
T154A263346FD50EB2E3BBDBF285F7D2C6A975B4367A03591E80450B841823A11DDA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download