b34c34e27aae59dcf6293dda17976327c69142d3b64c67ea0a6f25b5b20288b8

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f4ec776efc978079d789209a5c84b256_elex_wannacry.exe
Size 64KB
Sample260802-jkfz9avybs
SHA256 b34c34e27aae59dcf6293dda17976327c69142d3b64c67ea0a6f25b5b20288b8
MD5 f4ec776efc978079d789209a5c84b256
SHA1 777105639df2d74a91c9c37c09b806d095c39e32
SHA512 70b76981a82fd178978bf9717e51c9c657fe0ddf1c360c2a39ab63e37cc8f899aa1f551e02b36344369a2b148b9f518253025d8b819688b8434c72ca34037162
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25J:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25J
TLSH
T133537A38AED51572E37BDAB6C6F251C6F975BC223D02680D408673850C33F66EDA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5912	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_f4ec776efc978079d789209a5c84b256_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 5912	2280	2026-08-02_f4ec776efc978079d789209a5c84b256_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f4ec776efc978079d789209a5c84b256_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f4ec776efc978079d789209a5c84b256_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 65KB
SHA256 427e0d15f8ba1e7d6f014b1e14f8fb229104923a1b4406cbd604f59e4219fccd
MD5 5c508e78c6b87a2226c06d381c31d7b7
SHA1 e5ea1c3ff5aeb92d08f6d8144cbe4b8df8264481
SHA512 c5246c76c993d13dcd79bfb8cd971cc2b80e4c9ffaefc4c67c7f421d4e095f409cd5d4120fb02397a6443cb143e3a8501648a8e64ab2b52f8b54b4efeace1a3c
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25G:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25G
TLSH
T1E2537A38AED51572E37BDAB6C6F251C6F975BC223D02680D408673850C33F66EDA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download