8c78bee5ccc0dab9d2ec39d8e8f5c0d33350b35be5aa24ee271925cdfc9417fe

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_21288efd523e817d2ffd0819e25483ad_elex_wannacry.exe
Size 54KB
Sample260819-27thzaab75
SHA256 8c78bee5ccc0dab9d2ec39d8e8f5c0d33350b35be5aa24ee271925cdfc9417fe
MD5 21288efd523e817d2ffd0819e25483ad
SHA1 d26d5f847f33efb9590642a0d27354e00af5943e
SHA512 55d829a96334001ef1f6664d8167964c6b88923113dac51a8d7e6c68b6c73f55e089c4c19c1b9be962dbc221c0ee8cb767a86659ea2c776eecb0e0010d525a15
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwWqauCE:nAYTjipvF26uCE
TLSH
T1BF43D6297FE55872E3BB8A7544B641E2553ABC227DA2851F3841338C8873EA1DD64F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2948	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_21288efd523e817d2ffd0819e25483ad_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 2948	6016	2026-08-19_21288efd523e817d2ffd0819e25483ad_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_21288efd523e817d2ffd0819e25483ad_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_21288efd523e817d2ffd0819e25483ad_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 54KB
SHA256 b724c8fc7fd85fbc479625d769d950370b60bb3799aef0d33bf3cd1be4f988b8
MD5 3cbea536b46a307b0c5ccd4643724372
SHA1 4833e73ea63f9a53228b6fa631dced55525f54fa
SHA512 1a3613b3b0d86df6a809b356a15740320948077dc0971cd84babb058602faafca4c13fbd2200b9db277386857a19f03164df0aec62d3f7e5fb683f28551e2f27
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwWqauCF:nAYTjipvF26uCF
TLSH
T13443D6297FE55872E3BB8A7544B641E2553ABC227DA1851F3841338C8873EA1DD64F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download