1caf8c0fc6a07a030da1fb1708eccb1b179ab2ec56e3c37523e8ec51ed78e558

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_d89a16eae22e08fb9380105379885777_elex_wannacry.exe
Size 54KB
Sample260818-py5testwgz
SHA256 1caf8c0fc6a07a030da1fb1708eccb1b179ab2ec56e3c37523e8ec51ed78e558
MD5 d89a16eae22e08fb9380105379885777
SHA1 8412a6d744d5b441f517783c48567bbac35ea04f
SHA512 a844414e2b971f6c4b4adcd0cf7beecc4d8d81edd5a472cc8aaa3398e269bdebdb0edf9dfa1331c79ab5ddd8ac4cebb2092384ec2c89676336a2f98c4e8cd6c7
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRc0y:rmwfKOj1TRf/2SZLO8iJu7B
TLSH
T17143AB3CAED51572E37BDAB6D6F215CAF975BC233901680D408633850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3024	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_d89a16eae22e08fb9380105379885777_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 3024	3956	2026-08-18_d89a16eae22e08fb9380105379885777_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_d89a16eae22e08fb9380105379885777_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_d89a16eae22e08fb9380105379885777_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 54KB
SHA256 502eae66415f00c7483b85fda8f70c62a382da9771988a8435759ce00a946ec8
MD5 b41446ad2c9b886d205ec39317b6c9ea
SHA1 1c3732817a4273da87f7e0f4b1ac7a8eb78bdf86
SHA512 b37eed1250679ab28fcf5a775e9921604288d596534ba6777e864ea7e2d561c090d8692d321368570c80c48b021c52fee6c092043306a2d09cb7fc5f1e3a42a3
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRc0n:rmwfKOj1TRf/2SZLO8iJu7Q
TLSH
T1D243BB3CAED51572E37BDAB6D6F215CAF975BC233901680D408633850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download