749f80b53afae0a114e61eea8abbec6de27d9b5bca1def6b5d8e887422c9f00b

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_3fadcbcc69d40441ccc17e32e8373fc8_elex_upatre_wannacry.exe
Size 92KB
Sample260802-1rf29sgk91
SHA256 749f80b53afae0a114e61eea8abbec6de27d9b5bca1def6b5d8e887422c9f00b
MD5 3fadcbcc69d40441ccc17e32e8373fc8
SHA1 26fbbbae32eda89308bb075c28174f88708590b5
SHA512 f29c8b94b60a78a5c0ee6e9f786d237deb6eced659343ffb6a6d5550b52085ac5d16b768a4e37aad39cde15cfc3011afd0063e920e53eab9271691828fe71a58
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbxhU:EAYeTpt
TLSH
T1E293D37CAEE92672D3BBCABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2712	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_3fadcbcc69d40441ccc17e32e8373fc8_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2712	1724	2026-08-02_3fadcbcc69d40441ccc17e32e8373fc8_elex_upatre_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-02_3fadcbcc69d40441ccc17e32e8373fc8_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3fadcbcc69d40441ccc17e32e8373fc8_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 92KB
SHA256 ba8ad1e6bcf1d593ed5089fec78ee09e14b2542cadb600925b267c6081a7f621
MD5 83ac5be90b57fb190ca7cef957b7b055
SHA1 673d2b0f31f9085da82e6ae95b1794cf9fd5669a
SHA512 fc78b48cbdb5848db6eea266023d4d36dfc04bef43516bd303a33b594b89d328a2a6bafdf398871a1d61e43badfa498b936e1aa84eaa222873f4241c654cf719
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbxhl:EAYeTp0
TLSH
T18093D37CAEE92672D3BBCABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1724-0-0x0000000000403000-0x0000000000404000-memory.dmp

Download

memory/2712-10-0x0000000000400000-0x0000000000407000-memory.dmp