waski | 3f59d47ea5d69144f097109418d92092d65599c639bf25fbc6bfd5005e557672

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_18d4a3b7fb779d39406526e8a12ecffb_elex_wannacry.exe
Size 18KB
Sample260802-k2mpsswzcs
SHA256 3f59d47ea5d69144f097109418d92092d65599c639bf25fbc6bfd5005e557672
MD5 18d4a3b7fb779d39406526e8a12ecffb
SHA1 1b13425afe9004e7628f85141bab876735ae68e0
SHA512 cba5a40242781f10372bf548e12d012b666e761e6174e86e83dd4a10a08bcd9e66de36aa2c62a1e49f9090a1b68c4420ebf5f238979a942259e3ce807c849197
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFy3nL6m:uTQWckBeEd6ml1pcg7F3GiElpd29
TLSH
T1C682A5356BD55D73E3BBD7B196F7C1C66975B02B2E03992E80481B882833A10DDA0F89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016cdf-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
3536	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_18d4a3b7fb779d39406526e8a12ecffb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3536	2096	2026-08-02_18d4a3b7fb779d39406526e8a12ecffb_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_18d4a3b7fb779d39406526e8a12ecffb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_18d4a3b7fb779d39406526e8a12ecffb_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 18KB
SHA256 3437f0e7472cb21f8a4623a61799ef81161e26d0f7515676e703277b16c04007
MD5 b1d0738883b23a2a412deb997853a6f9
SHA1 fde2b319f3e088e1f05c6a2cc8f57ae77233ea7a
SHA512 2fb86ac5f78f2596011ee401f7d4ae40613c16ecfb1ffb7507478223fef89adec3f380f06b3c1492b84f4b961f3173a6053eb485467dfc8079b9b3efac22fcfd
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFy3nL6P:uTQWckBeEd6ml1pcg7F3GiElpd2o
TLSH
T17282A5356BE41D73E3BBD7B196F7C1C66975742A2E03992E80481B882833E10DDA0F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download