b4dd3cb35f507be1dc969ea08c1089572a4e716777b2b9c074a4b501090fe2d0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_19fbad6f2f37142f30a5a1491fd0ea98_elex_wannacry.exe
Size 63KB
Sample260819-28974sbm3x
SHA256 b4dd3cb35f507be1dc969ea08c1089572a4e716777b2b9c074a4b501090fe2d0
MD5 19fbad6f2f37142f30a5a1491fd0ea98
SHA1 954eb46f82a1ff70ee3ae3be30db03115d998013
SHA512 6bd8546b314a0f728d9f57a9b8f7aaf2d64b53225c8392e996c454e5a3f14c4cd270dbf3989c671a5f0c22c93c5b090c11b570356c6215dd0b6b59ec8c07e5ed
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2Sj:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2Sj
TLSH
T1AD537938AED51572E37BDAB6C6F251C6F975BC233D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5304	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_19fbad6f2f37142f30a5a1491fd0ea98_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5304	4636	2026-08-19_19fbad6f2f37142f30a5a1491fd0ea98_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_19fbad6f2f37142f30a5a1491fd0ea98_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_19fbad6f2f37142f30a5a1491fd0ea98_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 64KB
SHA256 d130e04f27b7bd1e12212d27b029e8c4d8c69d9ea3e793245ac37a6229f0b03c
MD5 f1deefb7240439713d3c291d066c7697
SHA1 40e53098da8ba894ea16194f48f0754f16d5289f
SHA512 eb39d0e12be7f00620e0e4a3a125403daa812164a1b779e4ba68450ea107b4e5cf10ba011c2b7159d26cef2d8694b8d50c262cec2e522d2789f9c6d6f29861c9
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcW9KKldco2SH:rmwfKOj1TRf/2SZLO8iJu7I9KKlD2SH
TLSH
T103537938AED51572E37BDAB6C6F251C6F975BC223D02680D408673850C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download