aeba439c14360c075029871a85b186f23559cc080762bf48f4b589cd6634c47f

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_fa303a1b085b4f1a37013ecfbac7bbd6_elex_wannacry.exe
Size 14KB
Sample260820-hffy1styhw
SHA256 aeba439c14360c075029871a85b186f23559cc080762bf48f4b589cd6634c47f
MD5 fa303a1b085b4f1a37013ecfbac7bbd6
SHA1 c209190aa83262634b7f311a9c3cc07b4f785f2a
SHA512 7547d15dc4bff5e62c6c4e50bfd9d85c9c0e5e77db16a35beac3bb567f77b9b5cc301c5484e0902c0ba77d3f8ff0dd45fc973654389e7e7aac6cdb272d7b38f9
SSDEEP 192:JNvKVVPbGI3ph/P3dXuYNpzYHr7IBge3UpgZql1oynunZq3Gi9wn/zwhUSgE:JVs9GWh37NpzYH/ISm6g8l14ZqY09L
TLSH
T1CD622AE2CB99F423C36B51305E75757582B871EF378B6A3B08D21A9CF4972D39C0A285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1980	codecupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_fa303a1b085b4f1a37013ecfbac7bbd6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1980	1540	2026-08-20_fa303a1b085b4f1a37013ecfbac7bbd6_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_fa303a1b085b4f1a37013ecfbac7bbd6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_fa303a1b085b4f1a37013ecfbac7bbd6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
Size 14KB
SHA256 00dd3b4d2c7eb57246fb0eac2b1573b19ffb37f99fde95f4a517a042103c211b
MD5 bda2b7436b9695591743a98e1070d9f4
SHA1 3d578587aa23d4ec40bc6d8d12873b8e2bb01ce1
SHA512 acecc781d780c3573bf29b3a1391b74122d2cc25cc18a95e9aec687286bd44f74699996f55642fb9c2d5e7b8478eeea7d738a30de756de3432ab203ebb345aaf
SSDEEP 192:JNvKVVPbGI3ph/P3dXuYNpzYHr7IBge3UpgZql1oynunZq3Gi9wn/zwhUSgH:JVs9GWh37NpzYH/ISm6g8l14ZqY09o
TLSH
T1AF6219E2CB99F423C37B51305EB5717592A875EF374B6A3B08D21A8CF4972D39C0A285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download