406133e193114f65f97ba9f26410d3c77b8dd89536bea30b6b2ed8905dab2d70

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a435715ec4332e34a57c040afcdec3f7_cobalt-strike_elex_upatre_wannacry.exe
Size 70KB
Sample260802-m6vbjsysc1
SHA256 406133e193114f65f97ba9f26410d3c77b8dd89536bea30b6b2ed8905dab2d70
MD5 a435715ec4332e34a57c040afcdec3f7
SHA1 b532b6d7523bdf6e7cd0c619c2e0dac70558fb4b
SHA512 29c4fc8fe432d58f4507ddc04133de47438080a0372d19dc8825f09f099ef60ea55a31687f6702241a79912a849df0fbcfaf2b75d2cf5c96814c0a7341b0a3d2
SSDEEP 1536:KAtY4WvLKb7TQdL31Aq+3WdRqer9B+TfS+yK+d4c+n0wJ1Z:Jtrw3mkRqer5+n0wt
TLSH
T14163D51E76A9A4E3C6328A38A87542955322AC627FC017DB7FC473CD4D372D88D67B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-08-02_a435715ec4332e34a57c040afcdec3f7_cobalt-strike_elex_upatre_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	zbhnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_a435715ec4332e34a57c040afcdec3f7_cobalt-strike_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zbhnd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3444	3012	2026-08-02_a435715ec4332e34a57c040afcdec3f7_cobalt-strike_elex_upatre_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a435715ec4332e34a57c040afcdec3f7_cobalt-strike_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a435715ec4332e34a57c040afcdec3f7_cobalt-strike_elex_upatre_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zbhnd.exe

Path C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
Size 71KB
SHA256 27dfb9c901fef81e5b928e9d5ba1e0d61fafee831a7081a9255bb01ba465f58d
MD5 a8cee90846160bc7fc144200bafd78b3
SHA1 3bbe497ece2bcec3184dc181ad90076f97b570c0
SHA512 3ffb7327c4c2c0f4a825283b36d79ac9c1562a029812bb7ca2c06abb91e16a89c50e66fcff9a13cfced7942a9ec864c60a96c32bd0c763e1e124b87ffceb8610
SSDEEP 1536:KAtY4WvLKb7TQdL31Aq+3WdRqer9B+TfS+yK+d4c+n0wJ1c:Jtrw3mkRqer5+n0wY
TLSH
T1CD63D51E76A9A4E3C6328A38A87542955322BC627FC017DB6FC473CD4C372D88D67B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download