a31472d6dfac76cccadc982bdee3648b02abf1c7f70c1a7d5b936cf94e539ced

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_8cb18639e85b8e3c5421579d77f49f9d_elex_wannacry.exe
Size 32KB
Sample260802-eng99sszbv
SHA256 a31472d6dfac76cccadc982bdee3648b02abf1c7f70c1a7d5b936cf94e539ced
MD5 8cb18639e85b8e3c5421579d77f49f9d
SHA1 47a40f2ce9e46b7bb507e8cddba6254bf9a8822e
SHA512 9b89b094dd0b748ec5cbe14a8f11874cff355b3c7f323bc05cbeceffb36c9707ea0649da1ad3c4cdb3836f4f71b8fbadcac4760ca80742f2f34266707d88f7c8
SSDEEP 768:Q3NXvkkRfDjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+xNPSQU+yVlk8k9:EdbjXRrs9sINeZEtejlIkoLN127BFVnC
TLSH
T199E23334BFD454F2E377DA73F9F691C6B82679523802680C40966F8449F3B52BDA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4876	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_8cb18639e85b8e3c5421579d77f49f9d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4876	908	2026-08-01_8cb18639e85b8e3c5421579d77f49f9d_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_8cb18639e85b8e3c5421579d77f49f9d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8cb18639e85b8e3c5421579d77f49f9d_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 32KB
SHA256 e0f691239486bd17ab9acf5045b1e4caefd33f806d220bc801cc34906479574a
MD5 60b9f33bf9d66ceb8fc0bbf751ea3a57
SHA1 19c489e71313164ce2b9608a523f09b55e184f90
SHA512 b68b95976f1a8789875f936a314eee14b27e2c9967793b8d9a9246a4ae01515b263b002ac4030f4063d4e59f7d062a3dd01c0dd3825219864076f300ad8c7210
SSDEEP 768:Q3NXvkkRfDjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+xNPSQU+yVlk8kA:EdbjXRrs9sINeZEtejlIkoLN127BFVnL
TLSH
T1F4E23234BFD454F2E377DA73F9F691C6B82679523802680C40966F8448F3B52BDA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download