4999fc36e66a5fabed455e81387e96795d89b92c6713cfae38e25bf0f9f6ebd5

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_a1f7cc209541ba00766da245ba62b6e5_elex_wannacry.exe
Size 17KB
Sample260819-19ebdsxwew
SHA256 4999fc36e66a5fabed455e81387e96795d89b92c6713cfae38e25bf0f9f6ebd5
MD5 a1f7cc209541ba00766da245ba62b6e5
SHA1 d25576bdaccd478c8a1d08ddeb151a7d37fa271b
SHA512 64b212f32d66ca1b8df38f2282123e395a1f5873eabc0f800e92fd8744c41c4615c1189ce47284a8a79dbc7d47ffe0adc3af3be9e0d1a011c53ba9390e749a67
SSDEEP 384:JVs9GWh37NpzYH/ISm6g8l14ZqY09q/4seL:JVs952ISmO6v4s6
TLSH
T1D8821AB1CFE9E433D3BB86348EB561A2917478AF3F47692F0492068C9463B93DC15399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2720	codecupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_a1f7cc209541ba00766da245ba62b6e5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2720	4788	2026-08-19_a1f7cc209541ba00766da245ba62b6e5_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_a1f7cc209541ba00766da245ba62b6e5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_a1f7cc209541ba00766da245ba62b6e5_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
Size 17KB
SHA256 390645adf84d67244706d518a84a3840dafa544c35669f47e84c98f2a688cc4c
MD5 2f28faa2560f173cd3d053c310d9d63e
SHA1 26bc87564b272be4b2af0ac8cf38b680c9005a00
SHA512 ea1e4e0dc54936d5d8d88cbdd2590649a0f315cdb875fbf98f8407001c16df7998a04e4f8d20ded87e65e2c30fa4d1ea982faea661234566e9820560d98aa051
SSDEEP 384:JVs9GWh37NpzYH/ISm6g8l14ZqY09q/4seW:JVs952ISmO6v4sv
TLSH
T1328209B1CFE9E433D37B86348EB561A2917478AF3F47692F0482068C9463B93DC15799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download