1f453fabad40d218d5550120b6126162476a3c8c292ae79719ce9a9e9d60cc05

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_bd5a0a02175cd787a7e01da63fe97c3e_elex_upatre_wannacry.exe
Size 27KB
Sample260721-2bpvxavdrg
SHA256 1f453fabad40d218d5550120b6126162476a3c8c292ae79719ce9a9e9d60cc05
MD5 bd5a0a02175cd787a7e01da63fe97c3e
SHA1 697207e01b77c2bd44952d07a3bbc6109d6d2c42
SHA512 d415ee50927f2cde80bde221fca8b896bf2ec5eee7d0a6af8df16a6486a17b802eafec93050d5203bb87a7cecde11bea0bbbb02b5e01167eb14fe7c0bb354af4
SSDEEP 384:ytJWarmw0ypZfld14ZN8lHUvmeNvtBNF2QOe:kJWaiw0yppxb+pdtBNF2a
TLSH
T15CC220785FC61FB9F323CDB249B6968B6635BC21A662070F9040BB310833DB19B2DD95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5708	fmujp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_bd5a0a02175cd787a7e01da63fe97c3e_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fmujp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 5708	6036	2026-07-21_bd5a0a02175cd787a7e01da63fe97c3e_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_bd5a0a02175cd787a7e01da63fe97c3e_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_bd5a0a02175cd787a7e01da63fe97c3e_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Users\Admin\AppData\Local\Temp\fmujp.exe
  "C:\Users\Admin\AppData\Local\Temp\fmujp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fmujp.exe

Path C:\Users\Admin\AppData\Local\Temp\fmujp.exe
Size 27KB
SHA256 857a88eb90c3e2e9d9f47f164ab7b803f572fcfba9c4e4f44d5de4919058b3bd
MD5 dd2b575a309d23bca90121658a071e5e
SHA1 e3f744533361b8beda9ea8cb6f4b3c4ea33ea583
SHA512 0a611a8ecb892e5909fae97675788a775128b8360d162ad3f083f6f27a8c562189d85c9857f98d60e70e87436519542667cc503d7b1a8c41355b1697b0f29afe
SSDEEP 384:ytJWarmw0ypZfld14ZN8lHUvmeNvtBNF2QOT:kJWaiw0yppxb+pdtBNF2P
TLSH
T10BC210785FD61FB9F323CDB249B6968B6635BC61A622070F9040BB310833DB19B2DD95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download