23732ec38bad7aba7f721fb47676b58c6392b6b01eb0e5fee265890489aad882

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_5ec0d1e70dcc38119ff3cabf9e05219f_elex_wannacry.exe
Size 21KB
Sample260801-vbk4dsttgx
SHA256 23732ec38bad7aba7f721fb47676b58c6392b6b01eb0e5fee265890489aad882
MD5 5ec0d1e70dcc38119ff3cabf9e05219f
SHA1 99cd7b262df05e61f17aa8b08990190059842ac6
SHA512 622008758a1c3b4429821c53f72931a7c894be66b499f49a26d91137bbc483a9b661363554b2fedaa3bb8cc4f8884e37e8e2987b37510d2090e887fa574a41c4
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJSD6:nYfoKSs71dv4/00CeuYw6
TLSH
T1C1A295386FE91E72D37BCAB689F392C5AD39B02379035D0DD48107498827B42ED91E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1256	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_5ec0d1e70dcc38119ff3cabf9e05219f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1256	4992	2026-08-01_5ec0d1e70dcc38119ff3cabf9e05219f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_5ec0d1e70dcc38119ff3cabf9e05219f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_5ec0d1e70dcc38119ff3cabf9e05219f_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 21KB
SHA256 9a6c093d9b943c2cf10faf1476cf2c8d60ce44213ded3059c8ff565ec029d659
MD5 651389730a3398e6812077e78c8d2830
SHA1 c391fbecc1a20ab272e1ddbc8ea6cfd1ac188a2e
SHA512 c8f49c44ae620330bd9d9cbc2e2f7837fdd99f4e675a32890424ab25160a35df8ad48e72115fe8345b6d4c1f35016b42f297b19a39010cce72986e88a219ff96
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJSD/:nYfoKSs71dv4/00CeuYw/
TLSH
T1B2A295386FE91E72D3BBCBB689F392C5AD39B02379025D0D948107498827B42ED91E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download