c592a98188d922eb154fab5fca74ea49a8af437ea34db87819e2efef7749d03f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_67c3b806bef342d45f8eccdfd30b6ece_elex_wannacry.exe
Size 21KB
Sample260802-wwkh2ayfpe
SHA256 c592a98188d922eb154fab5fca74ea49a8af437ea34db87819e2efef7749d03f
MD5 67c3b806bef342d45f8eccdfd30b6ece
SHA1 3e3b2ef41d807175d409abde5f843d635f20ae60
SHA512 990415360f854e79870fa0667d00f14a9e4fb2fa0a5dc51eb2409ceefb6f26ce3082ffdf42c7663a3a80eb207cc199180ff2e0fc04cc630d4f5f2d9559151063
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJ65Jd:nYfoKSs71dv4/00CeuY6t
TLSH
T137A2B6396FE91E72D3BBCAB689F352C6AD39B0227903590DD48207498817B53ED90E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3532	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_67c3b806bef342d45f8eccdfd30b6ece_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3532	2748	2026-08-02_67c3b806bef342d45f8eccdfd30b6ece_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_67c3b806bef342d45f8eccdfd30b6ece_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_67c3b806bef342d45f8eccdfd30b6ece_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 21KB
SHA256 6b518472535e875ba995896cafa858be57804614de5f59f141b23fde4daf53b1
MD5 3b9a113b099930fabd18586b41629f45
SHA1 5b772c2bc37a3c2c2623f87eaed9abab8060f2a4
SHA512 4f6466be475a52a63e9b00880743f4b87c2373797f3a67592d08f3daca8c2c8158a2a69715cc88b7192f122d371dd05bb5af50a4c63eff75596fddb9c993e9fe
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0CeuDqZH+dKJ65JI:nYfoKSs71dv4/00CeuY64
TLSH
T1A0A2A7396FE91E72D37BCAB689F352C6AD35B0227903590D948107498C17B53ED90E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download