d322b979a194d1f49d9f1101501e9a42aeb67ca380ada760c949ab5eed88c39b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_4581a2959d9b6b629f09e30e7512f6ac_elex_wannacry.exe
Size 62KB
Sample260729-2qrytaxtc1
SHA256 d322b979a194d1f49d9f1101501e9a42aeb67ca380ada760c949ab5eed88c39b
MD5 4581a2959d9b6b629f09e30e7512f6ac
SHA1 bba2d772098e18a52b1ac5a4043e76c8779cb71e
SHA512 f8dbd07e7efa1ed1e29fdd9fb1bcc27e5cef4b99ed7df2897b3b1722aa4c4d35194ebae0880188abe3705b2b4e14f6af65e60130b283ce4bd14991fcce0ef285
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAe:QbjXRrs9sINeZEtejlIkoLN127BFVn2K
TLSH
T1D153BF38AFD515B2E37BDAB7E9F651C6B975B4233C026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5032	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_4581a2959d9b6b629f09e30e7512f6ac_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5032	4868	2026-07-29_4581a2959d9b6b629f09e30e7512f6ac_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_4581a2959d9b6b629f09e30e7512f6ac_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4581a2959d9b6b629f09e30e7512f6ac_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 62KB
SHA256 130c5101ccb9b7ad68838330da5744733cec74e2bd0f1934b392a1e44caa35f0
MD5 05ecc3aa35186f6363b97e168c27ed66
SHA1 955b08b732d8d2520010c43e89ca93a437d9a0d7
SHA512 4759c55b45067015e1da401c65540c7e1be09727f45d9ad3c702b5f25f26bce9ab90357c2303406cbcb0460ff674711057e26de38b590756aee618137f0c535f
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAL:QbjXRrs9sINeZEtejlIkoLN127BFVn23
TLSH
T18D53BF38AFD515B2E37BDAB7E9F651C6B975B4233C026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download