9f7c320bed734a17c489ef7429814589e0bfd46835b0b93c1ee1b58ba4ad6354

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_66b79bc79f740ab79b3f2d9c4da14f32_elex_wannacry.exe
Size 48KB
Sample260820-allgpack9x
SHA256 9f7c320bed734a17c489ef7429814589e0bfd46835b0b93c1ee1b58ba4ad6354
MD5 66b79bc79f740ab79b3f2d9c4da14f32
SHA1 ee653bf73e5fe45b29ce3dbf07c53889e4507189
SHA512 dfba689e4c6789043d3e5e15dbfda7c43bc0b01a0bcbad41fe9c682ffa934e3f168daaf3e9e491b4a832a5d6c9cca58193bf0b8a86ba938dcb34168ca1d7171c
SSDEEP 768:1NIlcanKw9hOR80PsED3VK2+ZtyOjgO4r9vFAg2rqi:EdA80YTjipvF2L
TLSH
T14823E6397BD149B2D377827244F651E59A32BC62BD62062F7C89330DAC32E629D45F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5376	ieupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_66b79bc79f740ab79b3f2d9c4da14f32_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 5376	3656	2026-08-19_66b79bc79f740ab79b3f2d9c4da14f32_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_66b79bc79f740ab79b3f2d9c4da14f32_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_66b79bc79f740ab79b3f2d9c4da14f32_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ieupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
Size 48KB
SHA256 18e2c4fc55503e4ef5e3197ee84b759eee5011fac04d35f642f9e9af7fb8bb43
MD5 7d4737f45937d148d4f3be68a566a7f1
SHA1 217486b81fa35850398fc0f588395f8171cb4ff7
SHA512 cc8a8addf02465f6e3def08bcb4f8886f060ecc767bd7e73be043b8c91aa71a7961b39f6419af254730a6a940c27314cf1bb55c5fc34c5d868da3e70b03423d3
SSDEEP 768:1NIlcanKw9hOR80PsED3VK2+ZtyOjgO4r9vFAg2rq3:EdA80YTjipvF2G
TLSH
T16B23E6397BD149B2D377827244F651E65A32BC62BD62062F7C89330D9C32E629D45F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download