b057ecf26ab61a6b92667693c713e97c03c1487cec0ad29179df011bb1e8be27

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_3bfcba072e0ebbd330fd61a1fc897588_elex_wannacry.exe
Size 24KB
Sample260808-kwtk6axte1
SHA256 b057ecf26ab61a6b92667693c713e97c03c1487cec0ad29179df011bb1e8be27
MD5 3bfcba072e0ebbd330fd61a1fc897588
SHA1 be772d5119819383e3314b81816fb88e0ae4f6cc
SHA512 92f3acac64b55d5737c8f6c9a91ea9fbb7492d48228cde0d78b34d91b8e6f6ee88fc6b670ceaae25d6324eb0081d84173592e652f203c15b7d7aab1460e14a43
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbiUa0:Kz2u4LJjBaECkLSi7xsYhaKDV4UF
TLSH
T186B27434DBDA5EF5E35385B788F2E6D11032FF22D1221E1DA4553B0108B3643A5A2DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
460	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3bfcba072e0ebbd330fd61a1fc897588_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 460	1112	2026-08-08_3bfcba072e0ebbd330fd61a1fc897588_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3bfcba072e0ebbd330fd61a1fc897588_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3bfcba072e0ebbd330fd61a1fc897588_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 24KB
SHA256 b710002164afd902bd8de098e2ccd2f7a6b72ae2152bad55a5cd2a30f80a4d81
MD5 6181ebc1f108e164697807b80f935a35
SHA1 c930815325a6e2efc60df8211d26c1e448afdd76
SHA512 8c2f31f0b5f44a885a6a2e9c72307d2c8516385974aa244d625dc45818ae60b8f8c20f99431788943eadd5818a0476a815f15439a24488d04f5a9ca8175a8be4
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbiUaz:Kz2u4LJjBaECkLSi7xsYhaKDV4U+
TLSH
T13BB27334DBDA5EF5E36385B788F2E6D11432FF22D1121E1DA4553B0108B3643A5A2DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download