23a896edf328e4b9e4501b58129ca36f49ee9c13db5e32eb69a96b6300819518

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4926088cb2b45a1739952d277e6364c4_elex_wannacry.exe
Size 22KB
Sample260816-ryzcraea33
SHA256 23a896edf328e4b9e4501b58129ca36f49ee9c13db5e32eb69a96b6300819518
MD5 4926088cb2b45a1739952d277e6364c4
SHA1 efdcc513c33a59ea0cd8590ee4024fff2502a5a4
SHA512 8cba3a05a79dfe8e0a9a2076b1eaff54179aac46d9d8743c0d82f534c067a5a7a2029d40ca6b0ded1c12da039a0b203897d4335edff0f15e64692441580190fd
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzsc8dTrkFnC4d:f9hM2dB4XAGZ7sc6HEC4
TLSH
T186A27238EFD846B2E33BDAB54AF695C66972B0227D06190D90CD73450C23F56EC60B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1468	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4926088cb2b45a1739952d277e6364c4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1468	4452	2026-08-16_4926088cb2b45a1739952d277e6364c4_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4926088cb2b45a1739952d277e6364c4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4926088cb2b45a1739952d277e6364c4_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 22KB
SHA256 5aeb8bc83832a4f36bd1deb0afa577fb25c82ae78e98aba7e58d59889c8a5567
MD5 250478886975b9c39abae66a675b3bd4
SHA1 1970d7fdf9736dcc625875e3db015b3c229638e1
SHA512 c5d03d221e339670676491cbfe18cf0912d04f95c22abd0eb5585dcbb86dfa1ae90fbffacba825c35c9bec277fdc7479c13b4e7d0e279a0bd94877a7199c2d9b
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzsc8dTrkFnC47:f9hM2dB4XAGZ7sc6HEC6
TLSH
T13DA26238EFD846B2E33BDAB54AF695C66972B0227D06290D90CD73450C23F56EC60B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download