5b1fb631c00273932859fecb626bf26a948d8e482144ac6e9914e3f133be6a03

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_691014ed478490c4931205756d375078_elex_upatre_wannacry.exe
Size 41KB
Sample260806-dmancsxvex
SHA256 5b1fb631c00273932859fecb626bf26a948d8e482144ac6e9914e3f133be6a03
MD5 691014ed478490c4931205756d375078
SHA1 12f20920a341e6e1abaf3ab52cf606a4d8a355a1
SHA512 73567b1dab6d7c93eb3812671d50c6d79ab5f0e768a0ac24dd8cd23cc741b3794a9153e9bd58711aa1513b27da5d051fac380ac114622d602c8bd58bd2b04325
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHv:AC2tUZdHAMEyngXtr
TLSH
T1EB13893CAED55572E37BDAB6C9F640CAF969BD233902680E508A73400833F97BDA151D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_691014ed478490c4931205756d375078_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2408	4716	2026-08-06_691014ed478490c4931205756d375078_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_691014ed478490c4931205756d375078_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_691014ed478490c4931205756d375078_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 41KB
SHA256 f17f192a70980e07849a1430d94370e336103a7b1b9e76fd15ef8294faf0838c
MD5 1bccd522a6e4764e6b65882c3db654c0
SHA1 d66493a32db64612094f442119c2aeb4ab3a2484
SHA512 c95cdfa745680a4815f989b2f8c4cf761f188e3da9ba7288d481ec904a78700dd1749b32111aa46d19dc8f5405d53f3f7385d0f88a9f8d0adffe2cfb53c40bdb
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHO:AC2tUZdHAMEyngXtS
TLSH
T1DB13893CAED55572E37BDAB6C5F640CAF969BD233902680E508A73400833F97BDA161D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download