948806da251ad19665a00b76560764613168147f2a55cafb90c8294130722fb8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8a95ea1b14305c9ba401111c43bec632_elex_upatre_wannacry.exe
Size 27KB
Sample260727-a4pbastdma
SHA256 948806da251ad19665a00b76560764613168147f2a55cafb90c8294130722fb8
MD5 8a95ea1b14305c9ba401111c43bec632
SHA1 f6bd64653d7135a1b4b788d06b550676f1f56524
SHA512 56b69b79d0e9fecdbb4099286b760a84bab560156ef5df569335e6490e3b50c72d0a243284255f12214c463270f3bd743d3091b275391b6a7e858791556db1e8
SSDEEP 384:g6TqfKFd5EXkLouf/Wuj4R9480qWAqd3YpS017qSFBfbQ:hF2+TA1zDjW+Q
TLSH
T15AC250C987840C2BD1D225BDE47982FBC4696E2DCFC041ABA661FCD6CC22AC170F5997
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3236	qsvsr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8a95ea1b14305c9ba401111c43bec632_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qsvsr.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 3236	5832	2026-07-27_8a95ea1b14305c9ba401111c43bec632_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a95ea1b14305c9ba401111c43bec632_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8a95ea1b14305c9ba401111c43bec632_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Users\Admin\AppData\Local\Temp\qsvsr.exe
  "C:\Users\Admin\AppData\Local\Temp\qsvsr.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qsvsr.exe

Path C:\Users\Admin\AppData\Local\Temp\qsvsr.exe
Size 27KB
SHA256 1688fc2d3bab39afa7140a3e78d557d9a2c8eac1aac2b03cdb2477f87fc7f7f3
MD5 f86cc3a024f37dec45ec069d47f8181c
SHA1 4765a84ca0eeef1c996c39c80be66867fb5a8ef7
SHA512 f5202d7768f01733fc6292d69dcc54a80d9a5efd7ce00872432a00f064ef4d5d551c000db25bd74b06a99b88e56016a2de2aee466d7a26da3ff742461fb04f17
SSDEEP 384:g6TqfKFd5EXkLouf/Wuj4R9480qWAqd3YpS017qSFBfbb:hF2+TA1zDjW+b
TLSH
T13DC261C987840C2BE1D225BCE47982FBC4696E6DCEC041AB9661FDD6CC22AC170F5997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3236-14-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5832-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5832-1-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/5832-13-0x0000000000400000-0x0000000000403000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads