33aeef09a507222a9d850bea41d0a4639c3b01511c6ca2a91585d54763713ef2

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_161ae2652597f93116a00fa45153c8e5_elex_wannacry.exe
Size 21KB
Sample260802-1y82maxzhv
SHA256 33aeef09a507222a9d850bea41d0a4639c3b01511c6ca2a91585d54763713ef2
MD5 161ae2652597f93116a00fa45153c8e5
SHA1 41657dbd0cf6bb393b65b7818c740cd459e380b2
SHA512 7e808e008829b27f3c3e9673b8cd6e9e11c32275a5d9663066f3d5095ed6dd2331cb475cc8b2154d2c5d56f2c7c91d05ee40fdef719148c15a40d2259a0e3d5a
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJ65Jiw:nYfoKSs71dv4/00CeuY6/
TLSH
T113A2A63D6FE91E72D3BBCAB689F392C6AD35B0227903590DD48207498817B53ED90E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3044	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_161ae2652597f93116a00fa45153c8e5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3044	2692	2026-08-02_161ae2652597f93116a00fa45153c8e5_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_161ae2652597f93116a00fa45153c8e5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_161ae2652597f93116a00fa45153c8e5_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 21KB
SHA256 75cf5db137dcf0e30ea67d38b598fafda98a316a2c733954cac9fddee34bb780
MD5 2b37b0fae42e8c41c4709a5d2f7daa50
SHA1 bfd58f9caddcffd3c4f079cf67b60071d43409cb
SHA512 b9b6d1c57e75b2435583ed7c18009906b603f24f8750e514ffd44ec01f711a32385cbffc271d507fedd8f0763d3b89f44444402c35c1cad5f1285d4f8886f3cc
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJ65Jib:nYfoKSs71dv4/00CeuY6E
TLSH
T1D9A2A63D6FE91E72D3BBCAB689F392C6ED35B0227903590D948207498817B53ED90E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download