77d7bf49a982e1290143c0edb130f2dea2080fb2d961d0bb5bc56b351a5db5b3

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_452472a9daacaa06acdfdabd359849c9_elex_upatre_wannacry.exe
Size 43KB
Sample260817-2asv6sam71
SHA256 77d7bf49a982e1290143c0edb130f2dea2080fb2d961d0bb5bc56b351a5db5b3
MD5 452472a9daacaa06acdfdabd359849c9
SHA1 e3a711e7d54c8cd943e39ebb6463d8b145c8a660
SHA512 322d21ea9ad423b35568faeb1fa510c31e9ace05952f4e0248c93958cfa1e659deb05ea5375fc72c520bbbdaff6d60e16664f6552d1cfa5b6c05cb880d9a56f3
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLUGe3Yq:AC2tUZdHAMEyngXtXUGUR
TLSH
T1F713893CAED95572E37BDAB6C5F641CAF965BD233902680E508633400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2948	edxmk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_452472a9daacaa06acdfdabd359849c9_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edxmk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2948	4140	2026-08-17_452472a9daacaa06acdfdabd359849c9_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_452472a9daacaa06acdfdabd359849c9_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_452472a9daacaa06acdfdabd359849c9_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\edxmk.exe
  "C:\Users\Admin\AppData\Local\Temp\edxmk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edxmk.exe

Path C:\Users\Admin\AppData\Local\Temp\edxmk.exe
Size 43KB
SHA256 dc2b328b595b3f4ed3ff3325a546598ccbddf0fa6884b545b9ba382a8ec8281f
MD5 8dac7b95c8e31f834b28a38115410d5b
SHA1 ff999481f0ae8e9b3f2d6b40b1d6be27a59b5ce5
SHA512 44c73e23de18371c4ebaa21698f4531a3a45468132c3df1b3c58a5312ce43a70aaa5a99c15e444d9c80eff733ad54921661f2801c972dd8988cdcf3600e045bc
SSDEEP 768:A/E+UlejKbjWwKtUZS6KUAghE3c1ng8B4tbHLUGe3Yo:AC2tUZdHAMEyngXtXUGUf
TLSH
T18D13893CAED95572E37BDAB685F641CAF965BD223902680E508633400833F97EDA161E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download