37dcdcb93ee7bba6bc95d40819e8e4b2ab88d5560ea6cb6876ac26bfb3d7a004

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5f1f5c676d6c0233cbddd2e06fc013eb_elex_wannacry.exe
Size 64KB
Sample260804-nvyehadp6z
SHA256 37dcdcb93ee7bba6bc95d40819e8e4b2ab88d5560ea6cb6876ac26bfb3d7a004
MD5 5f1f5c676d6c0233cbddd2e06fc013eb
SHA1 4e5144fb5b59c5c75c6f993de43d5c5dee8886a9
SHA512 6dc87aa9492925aae2577a751622e3ba0e5431ecd20b1b6c200aad191cb77ee0dcb173237b51f366f3e4b2be89cb51242c75538f939f1a7dc63971c158bde1e2
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco25b:rmwfKOj1TRf/2SZLO8iJu7I9KKlD25b
TLSH
T1BE537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3396	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5f1f5c676d6c0233cbddd2e06fc013eb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3396	952	2026-08-03_5f1f5c676d6c0233cbddd2e06fc013eb_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5f1f5c676d6c0233cbddd2e06fc013eb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5f1f5c676d6c0233cbddd2e06fc013eb_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 64KB
SHA256 e995ad65519dd5715e8bd1c278e4db4af6ba9cef3d173ed95b83bf21c9b5a007
MD5 f34f35cbd8725226d299bf1e73591f64
SHA1 c78bc5e4aaa6c990ddd0c9cbd818187cce322652
SHA512 829592159b4239199ed1d3f8e0b5f59add8213ab1a0905d1d0b1cf6b7a86bd9f662071dc05beaf3b7bbec03c9faeb1453a61c54b3d67cae0d65676b4209427f7
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco254:rmwfKOj1TRf/2SZLO8iJu7I9KKlD254
TLSH
T135537A38AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download