3d089ced80a8b8cadccb5c36e213506bce7de68d49f187f74eb64a24f0a7935a

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_d1c691fbd66b25682077a2460b52ade4_elex_wannacry.exe
Size 22KB
Sample260820-hhr43a1fle
SHA256 3d089ced80a8b8cadccb5c36e213506bce7de68d49f187f74eb64a24f0a7935a
MD5 d1c691fbd66b25682077a2460b52ade4
SHA1 cd474d8f323fee16da85a862b67cfedf7c208f29
SHA512 6a499691f1841bd387d9297420a8e6dc79cdd3e1da8af17174a180fc7bdfd7542834111e58d919136ce4296a3f679221ffce232d94d0485e7f7696d4cb4ae977
SSDEEP 384:I3d1kbT/qPbErCB5BhXHil1YY/eC5s53zaLrwHr3CejhLIS/6BYR:Wcf/ybErCfBpHSV/eSs53zaX4NLyQ
TLSH
T17EA2607DAFE95972D3BBCA7988F651D3A93574233E421C4D80C213884C23F66ECA166D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3468	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_d1c691fbd66b25682077a2460b52ade4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 3468	1824	2026-08-20_d1c691fbd66b25682077a2460b52ade4_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_d1c691fbd66b25682077a2460b52ade4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_d1c691fbd66b25682077a2460b52ade4_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 22KB
SHA256 24deb0f252dd3c5f303f3e64476b2b3a3aa2c988390cc541e56eb783d8f684c3
MD5 a067a108e4b46657701bfd1413de6b23
SHA1 b87155946ed2838fe8392bb39e6d4251f85d269e
SHA512 17188034249ce3c041638be4008783853d9eed3791a6c0c4759f9be5a59743c2732bc6099f234a938d40f7e65a34944a4b83b02dd28fd4fd2fa89e3f41bf8b72
SSDEEP 384:I3d1kbT/qPbErCB5BhXHil1YY/eC5s53zaLrwHr3CejhLIS/6BYg/:Wcf/ybErCfBpHSV/eSs53zaX4NLyx
TLSH
T18FB2507DAFE51972D3BBCA7988F651D3A93578233A421C4D80C213884C23F66ECA165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download