ad43fcd7bb525a4a365f1ef2e58062b9637f743410adc7f65f42147518af405c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_60604ca4b9502d28e9cd67f2441cdc06_elex_upatre_wannacry.exe
Size 42KB
Sample260804-s263fada86
SHA256 ad43fcd7bb525a4a365f1ef2e58062b9637f743410adc7f65f42147518af405c
MD5 60604ca4b9502d28e9cd67f2441cdc06
SHA1 15222e91eca588446393503852b7282dc97e68e9
SHA512 e17b87bb86ece87a1009af9fdfe298c75373a49d6edcc0b93d1a170fea4ff5a7ff9e842c9955bdca8ce15b54ba60872618f5ca50ef4ff0126b3982df6afd7b1e
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLh:AC2tUZdHAMEyngXtXh
TLSH
T18013893CAED55572E37BDAB6C5F640CAF965BD233902680E508673400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4908	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_60604ca4b9502d28e9cd67f2441cdc06_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4908	3528	2026-08-04_60604ca4b9502d28e9cd67f2441cdc06_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_60604ca4b9502d28e9cd67f2441cdc06_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_60604ca4b9502d28e9cd67f2441cdc06_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 42KB
SHA256 e0da93ad52987b4fd9aae06a58d5ff9d0391c775b2cfc8d25253c5e9a4c8d2cf
MD5 3bfaf562f1e3c347db69fa3d8d566e3c
SHA1 7f25c895e701384e73e030d1c40f50f2b5caa367
SHA512 f3c0f405a1c54695c24282fe53ab5b997bb3025716eca084810676f88e6efc7521dc1f2422a81c10f911ae29b24e04d54476f158741d8aeec3f64abc8bf7c084
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHL9o:AC2tUZdHAMEyngXtXG
TLSH
T1C913893CAED55572E37BDAB6C5F640CAB975BD233902680E508673400833F97EDA1A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download