1a07fdfb704542bdf6db7cd1d35ef513b5f75f9da47b5af255112a22b02d882b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_946adf3149c1bab83e3958cabf7153d6_elex_wannacry.exe
Size 20KB
Sample260722-vzdn8aaa53
SHA256 1a07fdfb704542bdf6db7cd1d35ef513b5f75f9da47b5af255112a22b02d882b
MD5 946adf3149c1bab83e3958cabf7153d6
SHA1 f4e82515010b6f772ba486c1c65f248a2cedd6f6
SHA512 39788df732c6a3252019abb4090dddabe9d21d8e8c4691fff63230c3cb91d723aafbfaf39e4324e2b3a45637357cd17d7a7fdea566ce26c7783f881eb6f7e2bc
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzhSyMI:f9hM2dB4XAGZ7hF
TLSH
T1E2929438EFD846B2E33BDA744AF3D5C66972B0227D06190EA5DD73450C23B52ECA065E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-07-22_946adf3149c1bab83e3958cabf7153d6_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3176	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_946adf3149c1bab83e3958cabf7153d6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3176	4448	2026-07-22_946adf3149c1bab83e3958cabf7153d6_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-22_946adf3149c1bab83e3958cabf7153d6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_946adf3149c1bab83e3958cabf7153d6_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 20KB
SHA256 b02b5bbedd1828412adfc15d51070c75f37b33ceb9fb0d57beeff0b1556e1262
MD5 b492c75db5013ad8137fd2cdd72cb122
SHA1 cec2f61c5c02a765e2725fe09607cc8290df18bb
SHA512 c06686986c003e568024a28af9bf534cf8e542b41d5219ea81cb42076af28239a5d04b5ae73e98917a4bee7de0dc84997c2b4574bb96992449f324304919fae2
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzhSyMq:f9hM2dB4XAGZ7hD
TLSH
T12B929338EFD846B2E33BDA744AF395C66972B0227D06190EA5DD73450C23B52ECA065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download