48c2cf6a251783d98010ca3a8116c9bc897acafc29324ab81261dccf9c424336

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_62a509ed101d0094d537ed402e7a4e00_elex_wannacry.exe
Size 63KB
Sample260804-s2an8sda63
SHA256 48c2cf6a251783d98010ca3a8116c9bc897acafc29324ab81261dccf9c424336
MD5 62a509ed101d0094d537ed402e7a4e00
SHA1 e74ce66c3f0877805c059ca3e9f75867c2f9d288
SHA512 1fae8ee161b108cde61e838ee78a3dedf871e7ef604201364d896cd45faac3bda3618b9252621bdb37137786f2805866d37f38efe7c15a8769c5d2baeaf1228e
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2Se:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2Se
TLSH
T1CF537938AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2776	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_62a509ed101d0094d537ed402e7a4e00_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2776	2168	2026-08-04_62a509ed101d0094d537ed402e7a4e00_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_62a509ed101d0094d537ed402e7a4e00_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_62a509ed101d0094d537ed402e7a4e00_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 63KB
SHA256 cff53b212a941bf58404dd606c0a4dbbf38bcdff357be12e155f9cf9d38cad5e
MD5 a2c1945a3ecce2861f711bb5611633fa
SHA1 4d3fb3f93b1d87e73c4875bbe2ee7afa0428c0eb
SHA512 eb7e66dcf9d42649a7dc3ccf341075dca0a881eae73ae2fab53501e9a8f8ca01e6e8276e2ecb9c233cd64e2cda2270f0ff58be7573a40914186566644f565bdd
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2S9:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2S9
TLSH
T1DC537938AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download