b103d0b8789f1085519c3b34b0bd106110989c1c1e84cdc2c6d46523e02f7f1e

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f207971ea6b119b429dab36e115ddd7f_elex_wannacry.exe
Size 21KB
Sample260820-n666saweka
SHA256 b103d0b8789f1085519c3b34b0bd106110989c1c1e84cdc2c6d46523e02f7f1e
MD5 f207971ea6b119b429dab36e115ddd7f
SHA1 7dc67267c154d21638e017d7e6fc9df0fb80fe24
SHA512 439bb5396fe41d9cccf7fe391d96995513df47f7a8dd03fd69ce4d63443c3fd5e8389493f4ca24bc04d19b837d1df33b2acfc0323bf39a0cc0b7370597cc1e63
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecyE1PXIevdY7:d/3xd1HXzoyuXnvdY7
TLSH
T150A232F69BC108B5D533DEB9C4B27883A453B15E7D1A590D08D27F062F23753A8A298F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2716	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f207971ea6b119b429dab36e115ddd7f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2716	1804	2026-08-20_f207971ea6b119b429dab36e115ddd7f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f207971ea6b119b429dab36e115ddd7f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f207971ea6b119b429dab36e115ddd7f_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 21KB
SHA256 1a1f8f73968afb57dd5f5b4354051416ff1979e5bb4dbe3f093d5d5e61ca285d
MD5 3dffa97162fa8011771ecb0ae179537c
SHA1 64a53787f2ef195a763519b2d28544d27d41f734
SHA512 7f2c3a63caf615bc4b21397d58a616a4ff3e1aee8ee0fbb09210c8f5f64895b6ee2950716378e23262ebbd0f00708c5fffe7941eb444cc8d7d77475f4205b3e9
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecyE1PXIevdYk:d/3xd1HXzoyuXnvdYk
TLSH
T115A231F69BC108B5D533DEB9C4B27883A453B15E7D1A590D08D27F062F23753A8A298F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download