378b9bc00b6a2963879888992f90f6cbb746169c779267c317dd871038c5f628

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e33cb9f25e41c47e99176d564b820cc7_elex_wannacry.exe
Size 23KB
Sample260802-tya19scf84
SHA256 378b9bc00b6a2963879888992f90f6cbb746169c779267c317dd871038c5f628
MD5 e33cb9f25e41c47e99176d564b820cc7
SHA1 60946c04026efd0fdd8e4e8e47c5d1bd98bf211a
SHA512 bf58538411bace885cdfc026630788d29b4521fe545e02fb44791ed8c186deb4d25f4e1f05911e824adb00d3907c291e8e55e879c449035a730371c72ec18107
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzsc8dTrkFnCdI5uQZ:f9hM2dB4XAGZ7sc6HECdGpZ
TLSH
T11EB25138EFE846B3E33BDAB54AF695C66972B0227C06590D909D73440C23F56EC60B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4952	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e33cb9f25e41c47e99176d564b820cc7_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4952	2692	2026-08-02_e33cb9f25e41c47e99176d564b820cc7_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e33cb9f25e41c47e99176d564b820cc7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e33cb9f25e41c47e99176d564b820cc7_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 23KB
SHA256 7a8d6369ca9537701d991fa1f38fad53cf21f27056bd813e13bc7dc02999e2ac
MD5 ac00e88436255a600c897b63ecd3cf29
SHA1 b236479c3d4359fa46672cc466c3133264d2ea3a
SHA512 c1dded57214c38ac3fce46e49075928bc98abe316e82d6dd099ed4955d36e869bd2e1fce8b45c043086a4e268979b3cafe7fa471fca976a0917239e975859016
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzsc8dTrkFnCdI5uQU:f9hM2dB4XAGZ7sc6HECdGpU
TLSH
T1D2B25138EFE846B3E33BDAB54AF695C66972B0227C06590D909D73440C23F56EC60B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download