b01c12025c5d8c709fc050062ebbb9db1dafa1f7892e92ff91f6b0385fbcae62

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_236641b0fbb0fc342084e904ee67efee_elex_wannacry.exe
Size 63KB
Sample260728-ka45rssyex
SHA256 b01c12025c5d8c709fc050062ebbb9db1dafa1f7892e92ff91f6b0385fbcae62
MD5 236641b0fbb0fc342084e904ee67efee
SHA1 d9bc8e85db9adc9fd86ad215dea9342caecce463
SHA512 569e2878fa30b19b4c1dd47d67eb7f77fd4bd886e29120d475e99b9b80c60153c1e0fb433396e2c170d370b27f0038a504ca0a31cb0d3e8570a2e12219ffeffb
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2i:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2i
TLSH
T16C537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5572	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_236641b0fbb0fc342084e904ee67efee_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 5572	5220	2026-07-28_236641b0fbb0fc342084e904ee67efee_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_236641b0fbb0fc342084e904ee67efee_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_236641b0fbb0fc342084e904ee67efee_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 63KB
SHA256 774e73ab8140727ee5e17f07aba269e0045909c8b51a69f8962069a7ea37b8ab
MD5 e429d557471f21664b376c347abf9e4d
SHA1 5f867f0107aa1b63e6c6ef613e22cfe02daa6ffd
SHA512 26d5c7e3dfa39b12bf8edf552cd8ce4c888be8459357e345b2a6feeec452fb72744bad89a0cf53871dc81321fa29eb357a9e2233175b35454b638c7cc72ce36f
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2n:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2n
TLSH
T18C537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download