b1396b625220d761625b287f9a29b1e3852d59ae2b66879d3821c5921a4dfa61

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_056d95f61792f4f260933c26de4f62d8_elex_wannacry.exe
Size 29KB
Sample260802-pf8glasfme
SHA256 b1396b625220d761625b287f9a29b1e3852d59ae2b66879d3821c5921a4dfa61
MD5 056d95f61792f4f260933c26de4f62d8
SHA1 23b13de9fa4e737da219ebcf6eff4dd161349887
SHA512 a06b1b4ae2003c6e822a6663939bfed34ed5ed1a760da66f55bf83fc3013ca83ef0ff2704d74db93fb631001c6e8078af8edc2172a54fc0900344f3c5fe440d0
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pLC:Kz2u4LJjBaECkLSi7xsYhaKDVisC
TLSH
T1A8D22E38DBD959B2D377D6B6C9F2A5C2A872BE22B1111D0D548637000873B43A9E2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5740	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_056d95f61792f4f260933c26de4f62d8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 5740	3500	2026-08-02_056d95f61792f4f260933c26de4f62d8_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_056d95f61792f4f260933c26de4f62d8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_056d95f61792f4f260933c26de4f62d8_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 30KB
SHA256 a8f98bd6fbdb09d46a6a8218f1fd498b5aa82eac43836880e34215e472f68db3
MD5 f67053414ea946f74d764302cc3e3e66
SHA1 1a7c069e798bf137856552cb66b4d7f3fd69b8f3
SHA512 43ae247734b7c0c22d9b6774fc88bdd7944d1a5ed4a1df64d765167408235084c161fffdec82239657b259eae51bce69a33906f87a3006981e1b205eee741275
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pLbJ:Kz2u4LJjBaECkLSi7xsYhaKDVis9
TLSH
T1D6D22E38DBD959B2E377D6B6C9F2A5C2A872BE2271111D0D548637000873B43B9E2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download