a8b613b6fb8ad9f936efd98aeefe2df667872df6de63a92959f215fba0895136

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_1d817acafb0235a1e302eb2b3e57b9e6_elex_upatre_wannacry.exe
Size 65KB
Sample260819-c53lescq2x
SHA256 a8b613b6fb8ad9f936efd98aeefe2df667872df6de63a92959f215fba0895136
MD5 1d817acafb0235a1e302eb2b3e57b9e6
SHA1 c168d5328c7ff76b4892fc1d0789986cb232d3a7
SHA512 a95a06a840fdd0fc861b2c125f2addbc63a093e13aaf06f663753b0650a596c8a47c77cba766ee582194cd362437518042df9ec646132feb69fdf421c4b799e4
SSDEEP 768:OGkkeKLXo2LchMXEIPxQ3F5j0GoR+8lwkqVckaqshnCAK+4iCx/3G50y1K:GAtchMRxQE48lwVaqm5K2y/G50mK
TLSH
T11E6355386ED41672D3BBCAB6C5F651C6B921BC233D41590E4A8633C90C33F56ECA261E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5748	zbhnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zbhnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_1d817acafb0235a1e302eb2b3e57b9e6_elex_upatre_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 5748	1272	2026-08-18_1d817acafb0235a1e302eb2b3e57b9e6_elex_upatre_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-18_1d817acafb0235a1e302eb2b3e57b9e6_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_1d817acafb0235a1e302eb2b3e57b9e6_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zbhnd.exe

Path C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
Size 66KB
SHA256 8d3d71a76b9055ab228dc00fbd4c1758b1536975e5c11a4f562e7b569703d7b9
MD5 130fedafeccc51f10ab05ee3d44cccad
SHA1 83d65a45c176571eefa2e5a4886b55bb88599fa1
SHA512 ddd1b0b14cd0a8a260f7729af89a195c36af915020b8312b8e5a2e8d1e15652f92f56bcc3777ea23a996f83acef2ec6ed7db1389faa81279f1952c3c66cd00c6
SSDEEP 768:OGkkeKLXo2LchMXEIPxQ3F5j0GoR+8lwkqVckaqshnCAK+4iCx/3G50y1Q:GAtchMRxQE48lwVaqm5K2y/G50mQ
TLSH
T1166355386ED41672D3BBCAB6C5F651C6B921BC233D41590E4A8673C90C33F56ECA261E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download