5e127629dd1d2930b2b8765b69175fef10f793989b66528f68aa57933c19a3c3

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f035d3bfea957d768a8373eebed25abd_elex_wannacry.exe
Size 63KB
Sample260804-c5449abf95
SHA256 5e127629dd1d2930b2b8765b69175fef10f793989b66528f68aa57933c19a3c3
MD5 f035d3bfea957d768a8373eebed25abd
SHA1 184b7119486a9fb88f5564c8eea273e492307812
SHA512 f0c8a8f13d2cdb20223d19e89d7dcd10035b631d86007098d441480d8ed4702485283ac875e81dda76c65b7cd859167ee4236d381121ee10694c06c755461e48
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2SO:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2SO
TLSH
T18A537938AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2568	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f035d3bfea957d768a8373eebed25abd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 2568	5320	2026-08-03_f035d3bfea957d768a8373eebed25abd_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f035d3bfea957d768a8373eebed25abd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f035d3bfea957d768a8373eebed25abd_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 63KB
SHA256 04b8090afb9454940d6a093d3d665b5d14bd74cecce9cfbadc3f36900dbe78f0
MD5 e428ef0396930be612a0686d35da2171
SHA1 62eb03df19b17df082d324c0ede71928256a98fc
SHA512 7fc2e9b30126a092093593482d0555b67ce60be31eb884f653136f21a7a84e0625f7e325ffd935126fb8ae79b70cc277ddf9af3b493acc59ea4978c6d1b6ca7c
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2SH:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2SH
TLSH
T11D537938AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download