20c7ab0c42737801e30e18855c0c708cb6792adbddaf294fb317d457be6e2c17

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_3c625e099b1e3f160e1eea4bb61e694b_elex_wannacry.exe
Size 64KB
Sample260723-cb2f9scp3w
SHA256 20c7ab0c42737801e30e18855c0c708cb6792adbddaf294fb317d457be6e2c17
MD5 3c625e099b1e3f160e1eea4bb61e694b
SHA1 e51418371bf687e3962e05f91a3548df31b3f23d
SHA512 e01dc978262b065e758959f161f9a1bce3fdfcd9bb94343b9770b9b5ef49168ebe533f6f38939180bf94821705fe77381c6ae0acf1c07f5f9bfb4cf482ef218d
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25S:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25S
TLSH
T1A2537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1760	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_3c625e099b1e3f160e1eea4bb61e694b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1760	5056	2026-07-22_3c625e099b1e3f160e1eea4bb61e694b_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-22_3c625e099b1e3f160e1eea4bb61e694b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_3c625e099b1e3f160e1eea4bb61e694b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 64KB
SHA256 c65d5bfe39739e00397965b07a3e2b588b49d006b2effbd723c459c7cd4e96c9
MD5 07dd6da655a0978340d532058b16749b
SHA1 9ff1f15eaa39111f4b123c5aa492cedd3ad3b66c
SHA512 cb5a5b30fd591a87f2aaa51f0e3794adde7de2601259ca1adb772ef03dcf023917a9267f5cc332f1338e4cc7214c169406153c1c4432f1823e735f700aa93701
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25QM:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25QM
TLSH
T1F6537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download