ff51fa451da1ba2df6e58f34c7d5d0494686e0f9d1a04c5a06935df841bb2c95

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_bdb6def97a4d64c8197ed1612a18af88_elex_wannacry.exe
Size 29KB
Sample260818-22xcnsap21
SHA256 ff51fa451da1ba2df6e58f34c7d5d0494686e0f9d1a04c5a06935df841bb2c95
MD5 bdb6def97a4d64c8197ed1612a18af88
SHA1 3ec2416408393aef9e28f67cd4b71fa5ecb114f5
SHA512 2dd12dc63f0ce25cc2577118bded6fa8079404a424a1f4b44f1f116684c5f27a0af5619cdd3343fac984ff3a714105c5630a71e0b936be3842fb3db07ca18bee
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pcjp:Kz2u4LJjBaECkLSi7xsYhaKDViT9
TLSH
T154D21F38DBD959B2D377D6B6C9F2A5C2A872BE22B1111D0D548637000C73B43A9E2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-18_bdb6def97a4d64c8197ed1612a18af88_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4176	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_bdb6def97a4d64c8197ed1612a18af88_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4176	3700	2026-08-18_bdb6def97a4d64c8197ed1612a18af88_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-18_bdb6def97a4d64c8197ed1612a18af88_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_bdb6def97a4d64c8197ed1612a18af88_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 29KB
SHA256 dd1d0b1424ce65eb405e7c2bcf3512af4645da3fdc16f343630e5e1aec817392
MD5 56918263a779d771d0375cb2a24fa567
SHA1 47b8892abe1dcc86832bc68736b4e139287f5960
SHA512 07ed04f9bda881bbb122f4852d5758648956f3984a6a251f6c7efce7e5b572db9613d34adaf912df8c7e3dcefac2dac5b6a8bc3b8403662df9529d907534b0cb
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84pcj0:Kz2u4LJjBaECkLSi7xsYhaKDViTw
TLSH
T165D21F38DBD959B2D377D6B6C9F2A5C2A872BE22B1111D0D548637000C73B43A9E2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download