73948901529e772db520f493c5fe64737c555124200d62720a83162e7a92851d

Analysis

max time kernel
148s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_247b3906a39fa90d4cbb38af26b5502a_elex_wannacry.exe
Size 69KB
Sample260820-mbacwscf65
SHA256 73948901529e772db520f493c5fe64737c555124200d62720a83162e7a92851d
MD5 247b3906a39fa90d4cbb38af26b5502a
SHA1 b296f1862e1cb6678d54ac1f4b381d2b46d3c06f
SHA512 58295df9c1b1a53eb717040a9964df482c10b89db07d70c8e1b6bcf8a5df178bb9edf2f36deee6be5e092ed860a824eef8edcbf30f1ddc803611474c06dc7342
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJhH:D6izaOIUYTjipvF2nSQH
TLSH
T1FC63283ABBD55672D3B74371447640E2AA39BC223EA1091F3882334D4973F26DD66B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4516	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_247b3906a39fa90d4cbb38af26b5502a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4516	4088	2026-08-20_247b3906a39fa90d4cbb38af26b5502a_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_247b3906a39fa90d4cbb38af26b5502a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_247b3906a39fa90d4cbb38af26b5502a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 69KB
SHA256 d2c7a2032030a5891af95899be5c0d3cbff1542a343b55679241c109c9c758ef
MD5 8812807cf3de27eb5ecd967519e9da3e
SHA1 47680e666f3e462efc8d6274da0f4c9c54ad808c
SHA512 33605cfa6ff4f9552b9bbbe617a459dc91fbcd3f82805a75c664d7009ce595ecf25dee5d47b7b0fe0abc7219ac27d21e1c73e9a3a9c366853e20a84854eab127
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJh1:D6izaOIUYTjipvF2nSQ1
TLSH
T18B63283ABBD55572D3B7437144B640E2AA39BC223EA1091F3882334D4973F26DD66B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download