waski | e742b345244f54646a4f4970326a51af2bdff2426aec8f16d921f39e42095edb

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2bf818eb8fe56d02d4c365fb05e3904c_elex_wannacry.exe
Size 20KB
Sample260819-24xffsbl31
SHA256 e742b345244f54646a4f4970326a51af2bdff2426aec8f16d921f39e42095edb
MD5 2bf818eb8fe56d02d4c365fb05e3904c
SHA1 156586bbce510f336de5459bed26ff7b8cbdc8ab
SHA512 6c8b140a70560ef51fd75c35f4aa32cdd6de7ed7390f9742cc7ad86150c893ab47ce42c856eec142b497af88d8f78cb8935c1bf231f6ff9c856b915fd0be3e4f
SSDEEP 384:uTQWckBeEd6ml1pcg7F3Gih1uTRTF+2R3qC3v:uxckEEd62J7F3Gih1uTRTF+YqCf
TLSH
T1E09252395FE41973E3B7C6B685F7C1C6AC35B4373A03592E80861B891C23F11ADA1A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011374-3.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
4276	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2bf818eb8fe56d02d4c365fb05e3904c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4276	4516	2026-08-19_2bf818eb8fe56d02d4c365fb05e3904c_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2bf818eb8fe56d02d4c365fb05e3904c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2bf818eb8fe56d02d4c365fb05e3904c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 20KB
SHA256 0690ea8ba509c9684a1cbd3f27a8df45e3b4b756499690523ba4d31189f160f0
MD5 fb56d32ced11c76603cf1079e1e0c5ae
SHA1 2fbcc898e1278384df9ce72776fc25f5daf43ae9
SHA512 1237a198769b42e6b969f1d862642e5a55864b69ba71b980f9d0462145ff641b975f6ded0404b29bc4f6122ba28c40b869b9da5d67e5ce3800475c54d66f5f1d
SSDEEP 384:uTQWckBeEd6ml1pcg7F3Gih1uTRTF+2R3qC3+o:uxckEEd62J7F3Gih1uTRTF+YqCOo
TLSH
T10F9241395FE41973E3B7D6B685F7C1C6AC34B4373A03592E80861B891C23F11ADA1A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download