8d5fd3637c6d753957cb508c35468254b305851fe8efce241d9e4293d4903b07

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_01851dbbd7e622912ee6eb5b1db1eed6_elex_wannacry.exe
Size 27KB
Sample260819-3fb1aaythw
SHA256 8d5fd3637c6d753957cb508c35468254b305851fe8efce241d9e4293d4903b07
MD5 01851dbbd7e622912ee6eb5b1db1eed6
SHA1 7fe6f98f6f71c9c44a9d3af1f3a64758d2ec9ca2
SHA512 b35703a2444940f9a5c5e8f1c9a47a973bac2a50800b807cffdb887d80419b443befcb3d93513d66286aea33fde3a2280a81675748f08b78f31572609aed2a73
SSDEEP 384:JVs9GWh37NpzYH/ISm6g8l14ZqY09q/4soa5H+051RZnDh4ezokYh:JVs952ISmO6v4soa5eOfl4ezu
TLSH
T10CC21F799FE85572E3B7CA7AC9F655C2A835B4273E02581E00C207884C23F67EDA175E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4520	codecupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_01851dbbd7e622912ee6eb5b1db1eed6_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4520	4908	2026-08-19_01851dbbd7e622912ee6eb5b1db1eed6_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-19_01851dbbd7e622912ee6eb5b1db1eed6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_01851dbbd7e622912ee6eb5b1db1eed6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
Size 27KB
SHA256 deca6196a54f7d8b507ad81e209f3c8a94b8f34d1f3065c159ad0b457a6fe2bc
MD5 759288edb2a35c88ac7d5e975c2d0a4f
SHA1 d76fd0b2c2284abed274d228a53629ce1f7c8e3c
SHA512 800a47240f2b5840cb9075fcbe969dda63ddccc416165ee74e3173e6d4a4cb5697fbc20dd5fce164b696d6e7e46e8b1bf52a47958bcc82f5e1d6870ba0e945f7
SSDEEP 384:JVs9GWh37NpzYH/ISm6g8l14ZqY09q/4soa5H+051RZnDh4ezokY+:JVs952ISmO6v4soa5eOfl4ezB
TLSH
T1DCC21F799FE85572E3B7CA7AC9F655C2A835B4273E02581E00C207884C23F67EDA175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download