waski | 9199b34c2a324a53d192a04c32127e92288c6ec4af4c0d53e74856600d00717f

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3c9971c43bbbf6c4c1ec17498a08f236_elex_wannacry.exe
Size 31KB
Sample260809-vg9nyabe42
SHA256 9199b34c2a324a53d192a04c32127e92288c6ec4af4c0d53e74856600d00717f
MD5 3c9971c43bbbf6c4c1ec17498a08f236
SHA1 877ce861746b8332c901f444c3dd617296e063ef
SHA512 4239378f930e1896ab662067824100deb370c7dba4da9d055728b791dc328cdea35d1e6e2ee122eb981c74e0f7303b08a1eb64d4de76ba5c418d3392f64328a2
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsIe:uTKWckBeEd6ml1pcg7eMUUz624
TLSH
T1DAE273346BE45D73E3BBDBB586F7C1C5A975742A2E03992E80451B881C33B11DCA0F99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b85f-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
4760	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3c9971c43bbbf6c4c1ec17498a08f236_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4760	1964	2026-08-09_3c9971c43bbbf6c4c1ec17498a08f236_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3c9971c43bbbf6c4c1ec17498a08f236_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3c9971c43bbbf6c4c1ec17498a08f236_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 31KB
SHA256 dd5cd3fa6593df9cb99446445799a734da6d94e7a34ee615f941da3fe14f0cf3
MD5 4c3d777e35beb3d7f6fa79c36b7a425b
SHA1 12d532ec1acc86210f69f65c8dd6f6afc70ca65a
SHA512 6ab6e9df774bf135a60e539be319aa14e90913ec8dbdf7ed23a3a1808fed78fe869466c175adc02a983d0dd8940081fad9cc5f269edf4c2fd8d7080b7495396e
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsI5:uTKWckBeEd6ml1pcg7eMUUz62T
TLSH
T13BE273346BE45D73E3BBDBB586F7C1C5A975742A2E03992E40851B881833B11DCA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download