waski | aa880bc856ad69d62e8e33cfc82f4e710a1e8a049a2e36001533246ccaa7d77f

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_2a363dff6d30485e3b41fda4ce2bd9f6_elex_wannacry.exe
Size 16KB
Sample260801-rh1wmsbf57
SHA256 aa880bc856ad69d62e8e33cfc82f4e710a1e8a049a2e36001533246ccaa7d77f
MD5 2a363dff6d30485e3b41fda4ce2bd9f6
SHA1 99cfcb37084f27300f205d47db3c806823e0a3cf
SHA512 13d2233bd5e526997116a5db7dc9052d2194ab9e784cba2357af9757ee0519ac858abe268743d109b1c3fbbc5f9540c697bcf1c2ef0bcb8cc3d7531669de8cdb
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFAAYeUM:uTQWckBeEd6ml1pcg7F3GiElpNmK
TLSH
T10772B6356BD44C73E3FBD3B195FBC1DA6975742E37035A3F90882F892923A119C60A89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011396-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
2576	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_2a363dff6d30485e3b41fda4ce2bd9f6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2576	4592	2026-08-01_2a363dff6d30485e3b41fda4ce2bd9f6_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_2a363dff6d30485e3b41fda4ce2bd9f6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_2a363dff6d30485e3b41fda4ce2bd9f6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 16KB
SHA256 d02268eab9399baceee51c8801d9872883a9078b44aa286a50b3c4078a7b655a
MD5 8a750572e083c61feb203e8604166f71
SHA1 5d950add8da712464a1c5cc1bc760bed108ed4a7
SHA512 6c327e94d383a0dd06edd6a30135397a2f938458c4fa361e6c7be3debf25011ee3fec9fe8feee96a0707d8c9522d6c68cd896c9c7b82e6e4618e11dbd5d0a327
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFAAYeUj:uTQWckBeEd6ml1pcg7F3GiElpNm+m
TLSH
T13A72C6356BD44C73E3FBD3B195FBC1DA6975742E3703593F90882B892923A119C60A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download