2d128d1c8f55076b938abe0ccfd5ad606dae14aa811ac2f3193c83ae50388309

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_146fdb91febd515e0166a6ed7d03e33d_elex_wannacry.exe
Size 51KB
Sample260820-bmbvbacq8v
SHA256 2d128d1c8f55076b938abe0ccfd5ad606dae14aa811ac2f3193c83ae50388309
MD5 146fdb91febd515e0166a6ed7d03e33d
SHA1 e1ec1b1ca51beef4b29e74ddf3fef8f4c4d663c4
SHA512 4f9590bb7979997bc7830358feb3ad4187320e2ba53264f13cd963a7c17adb2d1b5f31d277fd4e930b73e92b049612ad687810d2aea1c6abb068248f3fa8d724
SSDEEP 1536:Kz2u4LJjBaECkLSi7xsYhaKDVZYTjipvF2F:KS8ELSGZYvQd2F
TLSH
T11D33F815F3D598F6E1670236487595E11132FE21ADB00A2F3C56330D2CB2E529DAAF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5900	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_146fdb91febd515e0166a6ed7d03e33d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 5900	4960	2026-08-20_146fdb91febd515e0166a6ed7d03e33d_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_146fdb91febd515e0166a6ed7d03e33d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_146fdb91febd515e0166a6ed7d03e33d_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 51KB
SHA256 f61f66e3d4545cbbc75a0c68a77ee3da8cb0a1a501ee09c53e627d5b07ae9e89
MD5 e74998388e5e7622366df485201b82e7
SHA1 70312c5a96bd6a0abed04f0d0793b80a483b1385
SHA512 dc370eeb663cb3b770e5007b52b85e751a4e5076a75842d3bd926ba7fa21c5563435b98b84fb7d023210467ed4ed10ae9166da5e07be5dddb9664e10c34a616c
SSDEEP 1536:Kz2u4LJjBaECkLSi7xsYhaKDVZYTjipvF2b:KS8ELSGZYvQd2b
TLSH
T1ED330815F3D598F6E1670236487595E11132FE21ADB00A2F3C56330D2CB2E52ADAAF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download