ebd26a1d7ecc10c4b16f1531022e2edef710df0d528ebef861f725bbe1cac28b

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_b4a080e209cd9bbec3ad774b3ed6153f_elex_wannacry.exe
Size 22KB
Sample260820-3hetysck71
SHA256 ebd26a1d7ecc10c4b16f1531022e2edef710df0d528ebef861f725bbe1cac28b
MD5 b4a080e209cd9bbec3ad774b3ed6153f
SHA1 445a0cd3366273ebb7de7451d1e535c5cea74c2c
SHA512 461fed710e1eb48587f794998105cf5cf3ee89c826740faff0dfcba5b6ca16d9f45a4f3973eca730c156b3c36aa601063ba1c3f9df9e5edc93537d570a0c93b0
SSDEEP 384:I3d1kbT/qPbErCB5BhXHil1YY/eC5s53zaLrwHr3CejeNlI2A:Wcf/ybErCfBpHSV/eSs53zaX42nA
TLSH
T10DA2837DAFE55972D3BBCA7984F791D2A93178133E421C4C80C213894C23F66ECA166E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1184	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_b4a080e209cd9bbec3ad774b3ed6153f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 1184	5164	2026-08-20_b4a080e209cd9bbec3ad774b3ed6153f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_b4a080e209cd9bbec3ad774b3ed6153f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_b4a080e209cd9bbec3ad774b3ed6153f_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 22KB
SHA256 f7b5a2ba122bd96c1591c29f2fe20032e520461a29dadbd71e8e10bb3de37d8f
MD5 bfe73565cefb7a13f38d0e823bbf8e6d
SHA1 70bde74c6dd45ed83a80950d53af2b372a53777d
SHA512 28750631b4853beddfd9947162f9fc2f75a115709d9c1207bea6288ba532d8ad697f70aadbe2f8ddda53bdccee9abba5b4f59b8a022f048025eaaedc736ab6db
SSDEEP 384:I3d1kbT/qPbErCB5BhXHil1YY/eC5s53zaLrwHr3CejeNlI2y:Wcf/ybErCfBpHSV/eSs53zaX42ny
TLSH
T128A2837DAFE55972D3BBCA7985F791D2A93178133E421C4C80C213894C23F66ECA166E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download