7a0f026a17b3a840d21fa290bd065b7446762c8de3758464552fcbdde87f90a6

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_63951d3208afecde0b07410bd1495f2a_elex_wannacry.exe
Size 25KB
Sample260730-ktfarafp8y
SHA256 7a0f026a17b3a840d21fa290bd065b7446762c8de3758464552fcbdde87f90a6
MD5 63951d3208afecde0b07410bd1495f2a
SHA1 aa1a26dabcd6d16eae54af389a7cde8bbfaced3b
SHA512 89feafbf8a0f40fdd9a51f8f144eaa4e11d5fbed53d97a67f42afbf1ff7d4cac91ec29a70eae933ff42cdda1818c5bbabbc9ce34b57e4397b5e9095ac0c7d03a
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbiWY:Kz2u4LJjBaECkLSi7xsYhaKDV4d
TLSH
T1C7C2A438DBD95DF2E37785B688F2A5811432FE22A5111D0D945A37010CB3B53E9B2EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
828	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_63951d3208afecde0b07410bd1495f2a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 828	5672	2026-07-30_63951d3208afecde0b07410bd1495f2a_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_63951d3208afecde0b07410bd1495f2a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_63951d3208afecde0b07410bd1495f2a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 25KB
SHA256 00735cdc7f888bdc98e9a6239e3391a6c11534f1cf3af1176f298026e878202e
MD5 65cb0c32c020ace863827d3d39522b66
SHA1 f8c358141ba0edeb2f2fcad838e2b9f2161cfd02
SHA512 03b855ebd27d11461e7a09affd7daade24daeaf7838c3f6bcebc1e369a4f84aa12b5b6be79ce6490c3afc46b220f92c59ea7b84bd0920571be7d8851830bb75d
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbiWR:Kz2u4LJjBaECkLSi7xsYhaKDV4U
TLSH
T1ACC2A438DBD95DF2E37785B688F2A5821432FE22A5111D0D945A37010C73B53E9B2EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download