e5275e579e99f3e8c1b25d1e1dd619d6d9ee8913b5773172e3dd2a3e8a14a4f1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_ad7ff30ec5d06b3b13d3b8e52b0ae37d_elex_upatre_wannacry.exe
Size 44KB
Sample260804-rx9gbsgn6x
SHA256 e5275e579e99f3e8c1b25d1e1dd619d6d9ee8913b5773172e3dd2a3e8a14a4f1
MD5 ad7ff30ec5d06b3b13d3b8e52b0ae37d
SHA1 2b1b36640f5141b4024884920435714f55471618
SHA512 79fe0415dfce770ce57cb62fbbeaed4f2c0d5acccf4ecb0b340b35a967bbf31dd42e1eb711ac4c80c0d25e717cb1665d49b44181162cf531755faedfb4065bb2
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHq/B:AC2tUZdHAMEyngXtu
TLSH
T1DA23AC38AED55572E37BDAB5C6F640CAB979BD233902680E508673400C33F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-04_ad7ff30ec5d06b3b13d3b8e52b0ae37d_elex_upatre_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3828	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_ad7ff30ec5d06b3b13d3b8e52b0ae37d_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3828	2488	2026-08-04_ad7ff30ec5d06b3b13d3b8e52b0ae37d_elex_upatre_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ad7ff30ec5d06b3b13d3b8e52b0ae37d_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ad7ff30ec5d06b3b13d3b8e52b0ae37d_elex_upatre_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 44KB
SHA256 0d54ca02d57c485d48fa98fcfd093ca097900884a704db6b550c237e81c5365d
MD5 b2e724d9857828eac8eb62b28da6a36d
SHA1 f518c2a9182bfd184cf22237187863d8114d0702
SHA512 6774af7d56e31c2870fce4c66984f3b6b11a420348cafe92130b8adf76a6411eda5bce440a372541d35cc8e9332f3b8238426a37660282be58d5105a2541dbc7
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHq/d/:AC2tUZdHAMEyngXti
TLSH
T1D323AC38AED95572E37BDAB5C6F640CAB979BD233902680E508673400C33F97EDA161D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download