3901edf5f6eb6c215fa9c0b43d6436aa19a02a55f599a5856b3d6a29b985aaf8

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_b339c791dedd345663086079a900435f_elex_upatre_wannacry.exe
Size 56KB
Sample260815-23da7awsfz
SHA256 3901edf5f6eb6c215fa9c0b43d6436aa19a02a55f599a5856b3d6a29b985aaf8
MD5 b339c791dedd345663086079a900435f
SHA1 22f742fe824848b9f33b85d41dacd18ab3c64f3f
SHA512 0a6a63d7eb3a93c59c9d1348fa9b251dc0098c9ea7e82d2b4342cebd8cf06ea704769725df7a3c31bf705189ec499f770ce2a6c7e28a57356f0466b542965009
SSDEEP 384:EqXJhMCEfgNfxAwMRGnkXF2MTNeUGpPdMYbsd/PwIsyUbSZBAPn+zNY8yrva92zC:EsJhM/44Ak12M5ezNG/2rb7+ZY/vAebC
TLSH
T12843063CAEE91672D3BBDABAC6F651C6B975B4233D02584E409703840C13F56EDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
624	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_b339c791dedd345663086079a900435f_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 624	5848	2026-08-15_b339c791dedd345663086079a900435f_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_b339c791dedd345663086079a900435f_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_b339c791dedd345663086079a900435f_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 57KB
SHA256 4ff46b06190cff58fb9e24aeda930bc7fc7c5911877b1a53d4c72c754f7b4703
MD5 843a2e4db8012ddf3c29af0cc24374d7
SHA1 ce2e0d5581a59b30426135f0bc1a6ebd508540ba
SHA512 d58f0838ffb27c71d788af827310ffc3e6800bdfd6c16a22f790fddb1532de33b6b23919c7696693843d750c69012b8bea931630bcf2b8d336fb1a0e3aaefbfc
SSDEEP 384:EqXJhMCEfgNfxAwMRGnkXF2MTNeUGpPdMYbsd/PwIsyUbSZBAPn+zNY8yrva92zz:EsJhM/44Ak12M5ezNG/2rb7+ZY/vAebz
TLSH
T1ED43063CAEE91672D3BBDABAC6F651C6B975B4233D02584E409703840C13F56EDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-10-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/5848-0-0x0000000000403000-0x0000000000404000-memory.dmp