ba329f652fc38335ae382de85216e39469d1583aa49d39b4f55a4013ede61149

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2ecef3100ae3ec4a1e6e52dcf9b22846_elex_wannacry.exe
Size 12KB
Sample260819-24ekmsab47
SHA256 ba329f652fc38335ae382de85216e39469d1583aa49d39b4f55a4013ede61149
MD5 2ecef3100ae3ec4a1e6e52dcf9b22846
SHA1 25b18ccbbf47ccc06e6f9a138b4e3d28c5605781
SHA512 c6b5dd37678edb40243cf720826ebd02f2a1e43cff22772f9294b4b29e949980190ac5bd7f7e4c63cee4b5698b09a3e454003b0d2741208398420cccea46ce1e
SSDEEP 96:J5+Q8vLkTWlAXzb2Wj756Qn/7ASniP8ciWJWJphnvIwmvv/FsuTl+MltboynnJPm:HTD/MSniPF8TvIn3ycFl1oynnJP8jQg
TLSH
T111422A12D7C53E26F3EA35B90EA7D51A8BF6F811A757324ABFC0128E3829152CC31346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4664	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2ecef3100ae3ec4a1e6e52dcf9b22846_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4664	3620	2026-08-19_2ecef3100ae3ec4a1e6e52dcf9b22846_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2ecef3100ae3ec4a1e6e52dcf9b22846_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2ecef3100ae3ec4a1e6e52dcf9b22846_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 12KB
SHA256 e0944b8ae954962473a88b60881544ccf615141bf493be3c02a7b9d12ef59656
MD5 8a7f454ec0774a6fbb89d372d361a503
SHA1 1d73228687cd3ad7ffb62c1340a13437c7b3d133
SHA512 b3be7c4d6aa63fdea645453314212087f9976482fd8cea2330f73c16328840ee2684ff6f2ecad8074bb2a4d2bac47da00b6edd32140b503c475c60a2bbe313a0
SSDEEP 96:J5+Q8vLkTWlAXzb2Wj756Qn/7ASniP8ciWJWJphnvIwmvv/FsuTl+MltboynnJPJ:HTD/MSniPF8TvIn3ycFl1oynnJP8jQD
TLSH
T1CC423A11D7C53E22F3EA35B90EA7D41A9BF6F811A757314EBEC0128E3819152CC31346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download