290ef950d9be19eb3c529aa3d34880e2350d4e7b1d8e2f372e5f8b843f22df0f

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e741df0c5acffbe590a5f28420e82ae6_elex_wannacry.exe
Size 29KB
Sample260810-vlcvrstdkh
SHA256 290ef950d9be19eb3c529aa3d34880e2350d4e7b1d8e2f372e5f8b843f22df0f
MD5 e741df0c5acffbe590a5f28420e82ae6
SHA1 3f98e72d51b0f40b00d1b90c63f1cb6badc07e92
SHA512 79016fdbf7ff02fd2c7bc9bfc4867bad84712a38f34b93cfcfca0dff39049323586816c9a27f95f31c366b8478f7607e7334d851cb8958a141f4da9d2c867705
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pqUJ:Kz2u4LJjBaECkLSi7xsYhaKDVirUJ
TLSH
T1E1D21F38DBD959B2D37795B6C8F2A5C6A871FE22B1111D0D948637000C73B43AAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3924	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e741df0c5acffbe590a5f28420e82ae6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3924	3868	2026-08-10_e741df0c5acffbe590a5f28420e82ae6_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e741df0c5acffbe590a5f28420e82ae6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e741df0c5acffbe590a5f28420e82ae6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 29KB
SHA256 99db54783d35ca0bbbdbde25e64af725472d51f8fc299302b1cc4a78594ca9d3
MD5 f7fa646d44fad8d22d2fe141e3b64f5d
SHA1 f626b8fd9fe2d20d792043c1033cf14be92340d0
SHA512 289ccae1ad99fd724aec3f353424a4b7920792d0543ba57f5b7fcf4ed5bf333ff1253b42fdfce0d63e368a2da26c74fa1cecc3cac1a4194123d9c9aea6610ee9
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pqUJ:Kz2u4LJjBaECkLSi7xsYhaKDVirUJ
TLSH
T198D22E38DBD959B2D37795B6C8F2A5C6A871FE22B1111D0D948637000C73B43AAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download