520c13c0bb959468d266f9de2bdb77709b6b49e6b5eea6b7d88e6a5fb38fd0dc

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_bec74bde7feddd510267ad9c2ebf9888_elex_wannacry.exe
Size 63KB
Sample260727-twlpzsca35
SHA256 520c13c0bb959468d266f9de2bdb77709b6b49e6b5eea6b7d88e6a5fb38fd0dc
MD5 bec74bde7feddd510267ad9c2ebf9888
SHA1 e031668445abb1d14ea7b05b0914fd069e12c8a8
SHA512 891f99122cd0743c95032ed52163864a2eb2d169a3e31c13639d4fa9ce429c802196a3c8bd506c8903b969b777564719b959d802c5313c33f9f875a8ed12a364
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2+:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2+
TLSH
T133537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5268	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_bec74bde7feddd510267ad9c2ebf9888_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 5268	4892	2026-07-27_bec74bde7feddd510267ad9c2ebf9888_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_bec74bde7feddd510267ad9c2ebf9888_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_bec74bde7feddd510267ad9c2ebf9888_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 63KB
SHA256 2cd9c0a68b244fe81678015cedc025853f117a521178ffa42d35c33064ed3c05
MD5 900a0820d2b1762c960f8ca00095db42
SHA1 0b3bb100fe94fe465264db9b858f1b5b72a44593
SHA512 8a075ff84c6f2ca7ec079fc34f2a4bc9cb48af7f61e51fabc97c34257d8a5baa4f226a86077171dc12ef1cbe91e3c814e239c0353c8c2971e79d6849d46051db
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2y:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2y
TLSH
T1E9537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download