14b40c996e3a1867905f45f843f05a1bc8c00a88a850f1169395836bd024fa90

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_c269a125bfead0d09bb9c99687fc8e24_elex_wannacry.exe
Size 60KB
Sample260801-tb5mcsswas
SHA256 14b40c996e3a1867905f45f843f05a1bc8c00a88a850f1169395836bd024fa90
MD5 c269a125bfead0d09bb9c99687fc8e24
SHA1 bde0011704340fe165fe102907797c39cd985d72
SHA512 f851501a52be213d67a9ceff23f1cbac7abda5262f55d4cfae7ca08228c3dc8daaa847ec9f8d8135d3831d019ee54c8b867c84acbdd5ff4cafe78c844fabfcff
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldcT:rmwfKOj1TRf/2SZLO8iJu7I9KKl2
TLSH
T1BC53793CAED51572E37BDAB6C6F251CAF975BC223D01680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5808	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_c269a125bfead0d09bb9c99687fc8e24_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 5808	5052	2026-08-01_c269a125bfead0d09bb9c99687fc8e24_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_c269a125bfead0d09bb9c99687fc8e24_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_c269a125bfead0d09bb9c99687fc8e24_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 61KB
SHA256 5bff59f4c4b749e95240fd985a3470d928e7d2f2ae4795b6f7e750b101bae9ee
MD5 92868d6081fbf79ef81ffb5ed50a9672
SHA1 47b8b171329e629600ccc287dd045f6ea36240df
SHA512 3033b25142d5025b97cf03e0b65d72c2cca32c249b221afbabd7bed8bc20ea1cc2478534a9beee82813480d2761277e8c09598738fd8dc6df4204c51409496e1
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldc3:rmwfKOj1TRf/2SZLO8iJu7I9KKlK
TLSH
T19953793CAED51572E37BDAB6C6F251CAF975BC223D01680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download