f35bbb1f9cb55911d84103884702d972edf58b45b81adce7b88169ed1a3ed3e5

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9411d7978dce8708664a90de55ab5ef7_elex_wannacry.exe
Size 70KB
Sample260818-3blc6abh89
SHA256 f35bbb1f9cb55911d84103884702d972edf58b45b81adce7b88169ed1a3ed3e5
MD5 9411d7978dce8708664a90de55ab5ef7
SHA1 09d062f130bbdb4e7b4998eeb9cd42a6718022d7
SHA512 a6370e03cdca3688f18914a23a570916eccf9a7a3e681bad8449800550d329912b03fd2d7bb8ad2d07e77bdf9778c6c803e695af85afd46ca03e49dd6029a397
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJrrb0:D6izaOIUYTjipvF2nSOU
TLSH
T15C631739BBD55672D3B7437144B640E2AA3ABC223EA1491F3882334C4833F66DD65B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4124	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9411d7978dce8708664a90de55ab5ef7_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4124	3600	2026-08-18_9411d7978dce8708664a90de55ab5ef7_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9411d7978dce8708664a90de55ab5ef7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9411d7978dce8708664a90de55ab5ef7_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 70KB
SHA256 35e11bee702d0d8cc4a0d1c79daac4b0a6a40455282effb8a667b8f85de646af
MD5 fd03ec395daf6fee6f8d37df2826f341
SHA1 8287bfaba3f5005c07b47bf9c7aa5c265a305fbc
SHA512 079780bc527e61a57efe1d28f5912379f5220630ea9e65a1e8c519c01d177e7619d11fe7c99ac756d920b3dc6888a2c08831442f9ca47df54c30040abadff2ef
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJrrb1:D6izaOIUYTjipvF2nSOV
TLSH
T17F631739BBD55672D3B7477144B640E2AA3ABC223EA1491F3882334C4833F66DD65B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download