777b78660259d9547ba4fe53340922ecd1e7a52fe048ccfa5b63252bf7e5a947

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_32824b3ab85f773d096537b979ed6a86_elex_upatre_wannacry.exe
Size 81KB
Sample260810-henbpsshpa
SHA256 777b78660259d9547ba4fe53340922ecd1e7a52fe048ccfa5b63252bf7e5a947
MD5 32824b3ab85f773d096537b979ed6a86
SHA1 675878289c6e86776b7e44d7e8be090229e52db7
SHA512 afa707ff61e7fd86128f48de433fc36f669b55f4fb7cf393b7753174e193b0adf00f2dbfb8dcd0276edb7b456a3d692e94bce4325a58211fc3811bff3673552c
SSDEEP 768:EsJhM/47dTkc8jmiG/7H1SE3KGdA6jVS2bnKHtIGA8/nVNEcoX7zPjqEJ2x0NXmY:EAA4R43e/7VOEjs2FRP2EJySmY
TLSH
T12E83583CAEE85672D3B7CAB586F651C6F975B8223D01580E608A13480D33F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-10_32824b3ab85f773d096537b979ed6a86_elex_upatre_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3212	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_32824b3ab85f773d096537b979ed6a86_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3212	4076	2026-08-10_32824b3ab85f773d096537b979ed6a86_elex_upatre_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-10_32824b3ab85f773d096537b979ed6a86_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_32824b3ab85f773d096537b979ed6a86_elex_upatre_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 81KB
SHA256 959ba8ae09024337ac6a62cce75bb5e2e3f68bd091962f5eb62c3db251e02a66
MD5 7c2456836371ee3a2b82f9c5b4c9d082
SHA1 6a0f771921c89617c6e31eb34d1a1e05d74dd97a
SHA512 eff07e430ecf25bf109859a4cb7f45c0e240543ee59a534abf2cf429bed0bf32eafb4b392fc7f629991a111c6e97f85101ae85ed3b4a2779615bcd9af6a32505
SSDEEP 768:EsJhM/47dTkc8jmiG/7H1SE3KGdA6jVS2bnKHtIGA8/nVNEcoX7zPjqEJ2x0NXmB:EAA4R43e/7VOEjs2FRP2EJySmB
TLSH
T1B883483CAEE85572D3B7CAB586F651C6F975B8223D01580E608A13480D33F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-9-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4076-0-0x0000000000403000-0x0000000000404000-memory.dmp