eed2c48fabbbd5133c1a24c7a4334de0bbe77c5e643fd69dbe2f130ac9b8e58d

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_8ed6939e405efea94e0bbca920e7540d_elex_upatre_wannacry.exe
Size 92KB
Sample260805-2b8ysaxeqe
SHA256 eed2c48fabbbd5133c1a24c7a4334de0bbe77c5e643fd69dbe2f130ac9b8e58d
MD5 8ed6939e405efea94e0bbca920e7540d
SHA1 8de182ec433f5fe4bc9376df50ad9e81fbfc9e10
SHA512 cd35db25513864e4c4a901e02df6d965add2c1e4c4f36db55f4e56b6ba5771038cfc3b79911f2b8504b7cf19641fb0cfc7aec59a5b7e1680de13982b5f677b73
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbt:EAYeTpk
TLSH
T1B093D27CAEE92672D3BBDABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2052	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_8ed6939e405efea94e0bbca920e7540d_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2052	4140	2026-08-05_8ed6939e405efea94e0bbca920e7540d_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_8ed6939e405efea94e0bbca920e7540d_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_8ed6939e405efea94e0bbca920e7540d_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 92KB
SHA256 3856f3104a13798c3b68c53e5f1a3674023279912c7ce05d7c41163ce39df1fd
MD5 5b215be91c489a69efc0380820b9bc12
SHA1 01992350e483f39b55ac560be0f5842ae7f3752e
SHA512 0d450287612096dc5ce65f70d18238015752ac9f276647f208b809977dc2139bed43511a64f888664edc381de30b0b2697c8357ef1593c02c2ffef914ae6e010
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbx:EAYeTpw
TLSH
T10493D27CAEE92672D3BBDABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2052-10-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4140-0-0x0000000000403000-0x0000000000404000-memory.dmp