waski | 86232a5d25e3c895e1ad5292c06d1391c412d53e1e542fb49746a021407fb613

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_abd9da37d4fa7c6247047bacd3c9c104_elex_wannacry.exe
Size 17KB
Sample260818-p3cnfabm21
SHA256 86232a5d25e3c895e1ad5292c06d1391c412d53e1e542fb49746a021407fb613
MD5 abd9da37d4fa7c6247047bacd3c9c104
SHA1 1a136cf8abefddee5aec2411114b86c589c17043
SHA512 6a38956961e4194048f87d14892bc86360786afadad982ec8eae0477220fc01f593a4f734430a3d2b0f2106685f849c8f58d1d9ae4fdb8dfd535061785105908
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFy3b6:uTQWckBeEd6ml1pcg7F3GiElpi6
TLSH
T1A472C6356BD45C73E3FBD7B196FBC1D66975702A3B03592E80881B892C23B119DA0B8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000019cc9-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
1492	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_abd9da37d4fa7c6247047bacd3c9c104_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1492	4204	2026-08-18_abd9da37d4fa7c6247047bacd3c9c104_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-18_abd9da37d4fa7c6247047bacd3c9c104_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_abd9da37d4fa7c6247047bacd3c9c104_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 17KB
SHA256 3dee553f644494867a1aa2ad91b1cb7790ae2a4889eeeb108a975c56218be6ca
MD5 6339e54d32c062be5b53c1821f9c7a4b
SHA1 30fa0c60d7880526106215fcf28f33f07c729d0e
SHA512 151b6b9b84379b0f77ec5989ede8ceee619ae284fb65af991d1ae4d682d0d1f1fd44a718e9d5c07fc797e967ac77844d7ca680d6df86452e75c3ff529706aecb
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGiEloCFy3bs:uTQWckBeEd6ml1pcg7F3GiElpis
TLSH
T16082B5356BD41C73E3BBD7B196FBC1D66D75742A3B03592E80881B892C23B119DA0B8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download