waski | b0f7721c1c429b28d18a11f7c4bf7e89544211cf76ce1b734e0bf4cb32d6dc61

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_4e80b3f8b5cad91011f0d9a3fa8a11a5_elex_wannacry.exe
Size 21KB
Sample260820-dnkvqayerb
SHA256 b0f7721c1c429b28d18a11f7c4bf7e89544211cf76ce1b734e0bf4cb32d6dc61
MD5 4e80b3f8b5cad91011f0d9a3fa8a11a5
SHA1 5fc8c3cddcd0eaee00d4bdff2cd5ad1aa6917bd6
SHA512 6f7518b843ddb64ed2979bb2b20bb0e2aacdc6de5daf94c169ee1b5d30a3fea53aed8011b5d7a4ce5c83bc77b93681f438bbf2f8869b7c827625eb2051e6b20a
SSDEEP 384:uTQWckBeEd6ml1pcg7F3Gih1uTRTUzT81PFh7/wrMe+:uxckEEd62J7F3Gih1uTRTUzT81z7YE
TLSH
T1F5A230395FE419B3D3FBC6BA85F785C6A835B4273A03591E408607891C23F12EDA1B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000016cdf-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
5368	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_4e80b3f8b5cad91011f0d9a3fa8a11a5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 5368	1052	2026-08-20_4e80b3f8b5cad91011f0d9a3fa8a11a5_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_4e80b3f8b5cad91011f0d9a3fa8a11a5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4e80b3f8b5cad91011f0d9a3fa8a11a5_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 21KB
SHA256 2c46c0ced615fc168ddd986b15d16acf130656e4029cae69e10e8ee1752e09b5
MD5 2e16d808dbfa33c074fb32699c40e5e4
SHA1 f563b74bea35f5ec8d705556efbc5eb067a9003b
SHA512 8c700072be798702f5221f4a7d36d7b58984ba8162226239ee762bf9cb5263ce9fc875ebc02d03649c1f9d09f8f4b49c41ceb9620fc3bdba5c6c344b56f2fcd1
SSDEEP 384:uTQWckBeEd6ml1pcg7F3Gih1uTRTUzT81PFh7/wrMe0:uxckEEd62J7F3Gih1uTRTUzT81z7Yu
TLSH
T151A240395FE41972E3FBC6BA85F7C1C6A835B4273A03591E408607891C23F12EDA1B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download