waski | f445af6454e37344a7154d9d8625665a8fb603c27c7428fc49b954227bf92541

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_33b302d5e81de23998314bdaec98e772_elex_wannacry.exe
Size 29KB
Sample260802-bdvk3abc28
SHA256 f445af6454e37344a7154d9d8625665a8fb603c27c7428fc49b954227bf92541
MD5 33b302d5e81de23998314bdaec98e772
SHA1 0dd7c6d75960725cd6f8256d21ba8b121f38158e
SHA512 afb95d4ba47e559405cb5f8e649783b5ede3f4583593d8ac15db7f3f63a1dc64dcc67cd88a09ca5945068f36c4bf726e2116d35d51b3062dbc64a3612ad80bda
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsI8:uTKWckBeEd6ml1pcg7eMUUz6vFH
TLSH
T136D2A7356BD45D73E3BBD7B186FBC1C6A975702B3A03992E84851B842C23B11DCA0B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001b664-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
2252	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_33b302d5e81de23998314bdaec98e772_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2252	5020	2026-08-01_33b302d5e81de23998314bdaec98e772_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_33b302d5e81de23998314bdaec98e772_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_33b302d5e81de23998314bdaec98e772_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 29KB
SHA256 88fd0df032a90739779e7fbd31a692e16fd5d6f1fe1b3594776c9bba52c1adf0
MD5 bbe176ac9e636bd7642ad79aa17266c1
SHA1 0e37218fd4f4ae31cf1a0257e718aea4318ee674
SHA512 0c93e8408cd4b0ac8de28f360a6f38c1848ef59445fe50b0a49518508146a83a0dfe57d1cb9b0f704c4b3f375967cb5fe122e024f29348433f4478e2f23a1cf0
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsIe:uTKWckBeEd6ml1pcg7eMUUz6vFJ
TLSH
T1A2D2A6396BD45D73E3BBD7B196F7C1C6A975702B3A03992E40851B842C23B11ECA0B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download