048e322ecae3c1e578ed33ddd79b2b3c52d06ca043a03fa012beadd8110dca8f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_93b0af11bc98b979d4d5344c2315b00c_elex_wannacry.exe
Size 20KB
Sample260820-pdfnsswfkh
SHA256 048e322ecae3c1e578ed33ddd79b2b3c52d06ca043a03fa012beadd8110dca8f
MD5 93b0af11bc98b979d4d5344c2315b00c
SHA1 8c0dce5a3c63387f6466859a0c30425e59d8bc60
SHA512 9b4896615f56ec12a696f8a9160140d07e833ea9e2d3f5fb693c618f1a001358e354bb835c1707f67ff3a2283263c1d3a976ca7bc4ce6598da1ce60717ad13bb
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mW:d/3xd1HXzoy44hXPW
TLSH
T1089264F29BC10DF5D523DEB984B27983A153F15EA91A5A0D08D27F062F23343A46298F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3536	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_93b0af11bc98b979d4d5344c2315b00c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3536	4648	2026-08-20_93b0af11bc98b979d4d5344c2315b00c_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_93b0af11bc98b979d4d5344c2315b00c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_93b0af11bc98b979d4d5344c2315b00c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 20KB
SHA256 7ace9ba8ced7ef08b420aee78eb9e8dc15857f72b3aec518eaac602ccb81e18b
MD5 0ca81b3268f2e4ee39bfcc5ae4d9465e
SHA1 606ac474533d7c10b1d1d81ad5b2aa19cd2dca0d
SHA512 00be386a066a954c65ee92da4ac57aa7b575f201cba7670de4565845b06b0402821aa7dd55bd5c08815fdb87894cf5c36ebc6e1204dba97405b3735ceeb59d0d
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mV:d/3xd1HXzoy44hXPV
TLSH
T1A59254F29BC10DF5D523DEB984B279C3A153F15EA91A5A4D08D27F062F23343A46298F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download