waski | dbf66f5fe497ef8235c6192503801f3beadba78f9b65c7e358f1cd5385078952

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_e7683996f356acbb33d5ab4636bd2665_elex_wannacry.exe
Size 13KB
Sample260820-m97q2syvbz
SHA256 dbf66f5fe497ef8235c6192503801f3beadba78f9b65c7e358f1cd5385078952
MD5 e7683996f356acbb33d5ab4636bd2665
SHA1 ec0e2a0232d215acd55e9388bd572ba4d60c42bd
SHA512 4656af7a8f475094387f0354404698cf3c6003e49f489b94a685a76b01d987b6902cf02a934ef1127f646c074815e9bad27c7af32d9a7889d71ca7d155394599
SSDEEP 192:j4vFJB76X8aN3T/MC4kmikwuCl1oynTcd3W6uCcbJrAAAAA4m+K:j4nBHA7f46l1JcV4rAAAAA1
TLSH
T1B2521B5B57A0C9B7F3958D34459B571CAB3634C3F912071EDAACA309CE72212D80E679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001b884-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
5864	ieupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_e7683996f356acbb33d5ab4636bd2665_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 5864	4924	2026-08-20_e7683996f356acbb33d5ab4636bd2665_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_e7683996f356acbb33d5ab4636bd2665_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e7683996f356acbb33d5ab4636bd2665_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ieupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
Size 13KB
SHA256 6e5dc84ff2bbe32b4dcba665279a6db851b6241b525d245da2d655a83acc3f18
MD5 38c111975133e88f6c7d2df59ae07a14
SHA1 24d40f41e5eb92adbb808b9721bcfdd12b419834
SHA512 1c98aa013e2d78686540ad1464f0890d809e4f56f3afab47c05dbb87134b1b4a1c91c705062241ad01816b6e21a83a4335df3e300d84613c588b84cb4edcdb93
SSDEEP 192:j4vFJB76X8aN3T/MC4kmikwuCl1oynTcd3W6uCcbJrAAAAA4m+6S:j4nBHA7f46l1JcV4rAAAAAlS
TLSH
T1E8520B5B57A0C9B7F3A58D34459B971CAB3534C3F912070EDAACA309CE72212DC0E679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download