ea73144b5215beec1171fa7e90ca7cd87446d1cc3c9427c40aefffbe09878090

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_5d5390003bb078d63fac32dc72ad0975_elex_wannacry.exe
Size 32KB
Sample260820-am1b8scl3x
SHA256 ea73144b5215beec1171fa7e90ca7cd87446d1cc3c9427c40aefffbe09878090
MD5 5d5390003bb078d63fac32dc72ad0975
SHA1 03bd13e826e86667f00fa9f40d7552f5f2fd0554
SHA512 65a16eb9ed0652b69c0b2c6898e759b3b75f00449ddacb1932a31b7e9f7e0be85538b5f102d145c028b3cbda7bc684bc4669f85a86f8b360730bfc87a344c835
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbimXf2Zc5VSkN:Kz2u4LJjBaECkLSi7xsYhaKDV4Bc3
TLSH
T105E23138DFD959B2E37785B6C8F2A9C66436FE3275115C0E508637400C73B13A9A2E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6060	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_5d5390003bb078d63fac32dc72ad0975_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 6060	4684	2026-08-19_5d5390003bb078d63fac32dc72ad0975_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_5d5390003bb078d63fac32dc72ad0975_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_5d5390003bb078d63fac32dc72ad0975_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 32KB
SHA256 2f4a82c3e71e3c4ca4e87f1f1e28666006bcf8892fb868a8e5c3f0904036276d
MD5 b863555601ce9db70bae5ad64c7f7644
SHA1 7ea720b395f0c0ef23db552bd8851877a503badd
SHA512 fea705fc408fd0fd85cf8cd4f41d7466133dfe1a586a0d11f42ab512c8312900f27a7d993068149b16f934e2cdad9ff7186acb507a4bcce8c7ee598b46549a03
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbimXf2Zc5VSkTb:Kz2u4LJjBaECkLSi7xsYhaKDV4BcJb
TLSH
T18FE23138DFD959B2E37785B6C8F2A9C66436FE3275015C0D508637400C73B13A9A2E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download