4bf5e6509ceed91941b5cb64033ae0ef6d0a8ca096dcd0eb7cc2d216e418e1f3

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_07cb868b5a481eac6668feacef3e643b_elex_upatre_wannacry.exe
Size 92KB
Sample260819-kppnmaswft
SHA256 4bf5e6509ceed91941b5cb64033ae0ef6d0a8ca096dcd0eb7cc2d216e418e1f3
MD5 07cb868b5a481eac6668feacef3e643b
SHA1 0fac6f3905b0563d5f377765669af78c1e79b8d3
SHA512 7a2e1636b8b24b1a656e6186bceec3e480828c2cadedf1874c532cb17009daf806405f4a56cc04333f9e88c8ce0831e2351f67ac13da01b1b4775a4f1c7ca0b6
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXb3:EAYeTpK
TLSH
T1B193D37CAEE92672D3BBDABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3580	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_07cb868b5a481eac6668feacef3e643b_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujek.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3580	2748	2026-08-19_07cb868b5a481eac6668feacef3e643b_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_07cb868b5a481eac6668feacef3e643b_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_07cb868b5a481eac6668feacef3e643b_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wujek.exe

Path C:\Users\Admin\AppData\Local\Temp\wujek.exe
Size 92KB
SHA256 5fe4ab4146a04756e4ca62067bd79547c998620b5d71d68741c25a59c1952c98
MD5 bf9be80ec9d77f23de2185441c9d24c1
SHA1 a4e3e2a4f006cdb99de5905aedd76a6b865df74a
SHA512 3cae51c8bc955f925c4a9a0807fd14516ce517a35fcf17bd090f9a71277e0f9d9e958999b8b6b912aff57f527f7020539f6506aab37e11702005356fcdd7fc5b
SSDEEP 1536:EAA4R43e/7VOEjs2FRP2EgSs0yrVMqXbw:EAYeTph
TLSH
T1DB93D37CAEE92672D3BBDABAC6F651C6B935B4233D02580D409643840C13F56FDA1B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2748-0-0x0000000000403000-0x0000000000404000-memory.dmp

Download

memory/3580-10-0x0000000000400000-0x0000000000407000-memory.dmp