8585e9c0268b6e5711c6a048fda77080f16f6ea73f28787454f9c9b33b7407c4

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ca1c3994ff7301dcf1bd3dd3fcf9235a_elex_wannacry.exe
Size 29KB
Sample260803-ksn69seq6w
SHA256 8585e9c0268b6e5711c6a048fda77080f16f6ea73f28787454f9c9b33b7407c4
MD5 ca1c3994ff7301dcf1bd3dd3fcf9235a
SHA1 754cd4c542fa4b71be0709c4fbfa7af2ea82d4e8
SHA512 e072cc757a5e87e8e6bad2ee96eb03dea252454bcba8599f0d6a7b4504256f92f1e8ea1bb2e05ba2e879991895096ca2270f29e40e2d566e5dbb70828cd5469b
SSDEEP 384:fCEsYRpfgBcDZG3snl1YgToPdDW+oPdDWc4oPdDWcoJ7oPdDWcoJGYs7KdyPIP1z:WYfoKSs71TKA4AoJ7AoJLaK+ItntY0
TLSH
T142D23AE35FBC4CE2D1BB0F381873965B8D65B12049223A01A9E470CFCE9E5D6C66C786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3224	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ca1c3994ff7301dcf1bd3dd3fcf9235a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 3224	924	2026-08-03_ca1c3994ff7301dcf1bd3dd3fcf9235a_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ca1c3994ff7301dcf1bd3dd3fcf9235a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ca1c3994ff7301dcf1bd3dd3fcf9235a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 29KB
SHA256 e8d89d44448b52e88932a0448e768a547fb1e4c9793d81ec24ff30a2a0a80805
MD5 8dfb6f2918e8553f83091ee773a80e27
SHA1 7ca5b02b77c526635ae621d032e4a59bbf7d094b
SHA512 14732831e725458456c5d7d1295b50f3118cc8c80fe23b0d6908554ed2b9f2c4719f67a0c4c6ebbb51a43090f92e6eca6b0d61fe4ccf56aa4f10fcfecaa2cfea
SSDEEP 384:fCEsYRpfgBcDZG3snl1YgToPdDW+oPdDWc4oPdDWcoJ7oPdDWcoJGYs7KdyPIP1T:WYfoKSs71TKA4AoJ7AoJLaK+ItntYE
TLSH
T145D23BA35FBC4CE2D1BB0F381C73965B8D65B12049223A05A9E470CFCE9E5D6C66C786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-7-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3224-19-0x0000000000400000-0x000000000040D000-memory.dmp