6d4f4289bebc2edf6fdd53372010ab46d52e0c02b30e58e812801ac5dd65a5b1

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_ac5564be7dcc3e3b5fd3aa1bdeacf048_elex_wannacry.exe
Size 64KB
Sample260727-lc1e2azvas
SHA256 6d4f4289bebc2edf6fdd53372010ab46d52e0c02b30e58e812801ac5dd65a5b1
MD5 ac5564be7dcc3e3b5fd3aa1bdeacf048
SHA1 18a8a8ef0654295cc443164125950e2d802f59d2
SHA512 538d5a5d527c81cbac4c2a19919ca8a1649eeacbb1d73f7e65be0ebf0cb9984142b979e394e292d01331eeb5d172e7652737acf1ffa09bb4c361a91bae91218d
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25i:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25i
TLSH
T187537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3388	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_ac5564be7dcc3e3b5fd3aa1bdeacf048_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3388	4300	2026-07-27_ac5564be7dcc3e3b5fd3aa1bdeacf048_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_ac5564be7dcc3e3b5fd3aa1bdeacf048_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ac5564be7dcc3e3b5fd3aa1bdeacf048_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 64KB
SHA256 c4c24aa13075bd6d2a2af0349aaff2af069c2701b1ae6f98072e2c6c3c7eda05
MD5 688fb74f43384800486a0a749f784c9e
SHA1 97f2151b20abfe0b885e8b870221d79f383d833e
SHA512 51fece0242754da2ba3b2c1ceaa22c3a3d13709d6a8108645c1a3f13b388a3471b48e5bfa0928fef01c423b5101c15693684b4f16714f8b07e70e6a8c125f1a0
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25L:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25L
TLSH
T138537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download