78e66fd34b98261cadfea9481cd194b225f5c016af50364cbe2988c51eb792b1

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_82e9916ee8a8bd2bb0e6f5967a3458cb_elex_wannacry.exe
Size 19KB
Sample260809-fyj3aa1dma
SHA256 78e66fd34b98261cadfea9481cd194b225f5c016af50364cbe2988c51eb792b1
MD5 82e9916ee8a8bd2bb0e6f5967a3458cb
SHA1 579795f873e0454c0ac315b66ea5a9ee2000e20e
SHA512 37baedcdd837ac91c36bb815eb8b8f4d9935094fb0b78e7ab701b4a67f7dc2eae9317ac045a8c18422f6c637825bc35f3586d3d88e8a09c6f7f5391daef672b3
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzSimU:f9hM2dB4XAGZ7SimU
TLSH
T12992A538EFD846B3E33BDAB44AF395C66972B0227D06590E65DC73450C23B52EC6065E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5228	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_82e9916ee8a8bd2bb0e6f5967a3458cb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 5228	4120	2026-08-09_82e9916ee8a8bd2bb0e6f5967a3458cb_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_82e9916ee8a8bd2bb0e6f5967a3458cb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_82e9916ee8a8bd2bb0e6f5967a3458cb_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 19KB
SHA256 b1969aaf19fccdbac0e1661f51ce60fcabbcd739a2275acd611d271b7b059292
MD5 781214b5d6d9f547eaf3015a38aa4d5b
SHA1 52c56ceee998ffe348c90af02006e2db983fc78a
SHA512 87e23241e88184c45d858b86dfe6aa9eb2a22dc3d12877f7c29291ffb37604aea05ed9970f0157007edcbdfe086304fd2dbf63fa78cc99b8ce684be1459a5106
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzSim+:f9hM2dB4XAGZ7Sim+
TLSH
T10E929438EFD846B3E33BDAB48AF395C66972B0227D06590E95DC73450C23B52EC6065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download