waski | d11567b9fe158c80be7c91feb2723afbf8ae5898ba3f3796cf1786e359f819b2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_4c23c8a4ca521d06e877f28c39314c35_elex_wannacry.exe
Size 36KB
Sample260819-kd7easstgx
SHA256 d11567b9fe158c80be7c91feb2723afbf8ae5898ba3f3796cf1786e359f819b2
MD5 4c23c8a4ca521d06e877f28c39314c35
SHA1 e6d05a3292492122f5da53305c0651610423f036
SHA512 ba9ecfc848d1f2e7c22842207f530a11f94bd329b5daaf47d8064ab768519f5184923b2725e4b31c2279de281ad6567092ff5a3d8bdb7205be916536d8c1543f
SSDEEP 768:uxckEEd62J798jBk3A6gow6vdBcl5sfuW5nrA8zjc52We:cc3ji6kgi1Bc7sR584jfWe
TLSH
T1BFF2AE3C6EE91972D3BBDAB6C6F691C6BD75B4233D02580E408647840C23F26EDA1B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000019ce0-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
964	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_4c23c8a4ca521d06e877f28c39314c35_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 964	5668	2026-08-19_4c23c8a4ca521d06e877f28c39314c35_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_4c23c8a4ca521d06e877f28c39314c35_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_4c23c8a4ca521d06e877f28c39314c35_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 36KB
SHA256 01caf896676b04b9c100dc401a461a1a501ac22c9c10dd6e529c2029276e4244
MD5 83f1ff2887f8e0e56350c795d605ffb0
SHA1 cdc368f7527a711155377b48f7bc66c543c31b3e
SHA512 c1301f5f22cc1d7050a69cdda2b054b309aebe0f7c428f76987ea864b3b0f8bea201023ee94d8d6d7b210c70d9c8d24ef81a0b0c14d30c74975235d7c88fa9cd
SSDEEP 768:uxckEEd62J798jBk3A6gow6vdBcl5sfuW5nrA8zjc52WN:cc3ji6kgi1Bc7sR584jfWN
TLSH
T1DEF2AE3C6EE91972D3BBDAB6C6F691C6BD75B4233D02580E408647840C23F26EDA1B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download