waski | 3d144c6b5d9aa7d4b0ebd838b320e5421da6c44a7fd2cf19450402cca3ee95cb

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_40c9d3c0f8f081ba8d697cc1f98f16c3_elex_wannacry.exe
Size 14KB
Sample260820-arydfazsa1
SHA256 3d144c6b5d9aa7d4b0ebd838b320e5421da6c44a7fd2cf19450402cca3ee95cb
MD5 40c9d3c0f8f081ba8d697cc1f98f16c3
SHA1 ef9fd061f1bf454c969c7b9b61932ceef5d5eba9
SHA512 4a8414e4fef91c0f691f1f672b1b3898c32416cd114e261c2890b9f195b27f4c44308efc906cf16046a4a041c8669dc321e3a5243a5a2dadebe81f6eb72ba68f
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGihJoAk:uTQWckBeEd6ml1pcg7F3GihJS
TLSH
T1F962C4329A915DB3E3EBD3F255FBC2DA9965B02E63035A3F94482F8939235005C94EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001b896-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
4204	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_40c9d3c0f8f081ba8d697cc1f98f16c3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4204	924	2026-08-19_40c9d3c0f8f081ba8d697cc1f98f16c3_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_40c9d3c0f8f081ba8d697cc1f98f16c3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_40c9d3c0f8f081ba8d697cc1f98f16c3_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 14KB
SHA256 21201440ae260892df4f6ba70c8c6bdd74b23e67c767056fcca293e0757a93c5
MD5 327ec9800cc87d37615000bc30f99455
SHA1 079faefca5f2526855e5a76df632fb967d249307
SHA512 9cac1f30736d56274ce59f9da7cf6156c92cdf04dc2a134a007b7127f730f9b3622459946db424e33bb30c330d29ed12d98c61d997e7a36fae534e4d1fe0c04b
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGihJoAF:uTQWckBeEd6ml1pcg7F3GihJX
TLSH
T10562C4329AD15CB3E3FB93F255FBC2DA5965B02E63035A3F94482F4939235005C54EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download