ecf65d0f8425cbf76f65f9c418ebf653da6bc61d3197827ded96f6f24b2ea474

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_67f611defd7ecdf74c5125ba2758cd0e_elex_wannacry.exe
Size 17KB
Sample260820-psq33szyft
SHA256 ecf65d0f8425cbf76f65f9c418ebf653da6bc61d3197827ded96f6f24b2ea474
MD5 67f611defd7ecdf74c5125ba2758cd0e
SHA1 e18de5d0b00fbce5583545c6579cbce14c5ce1ff
SHA512 012465a9d8880fde645f47dd51c806c92e36d02390321c663a2b6024a23cbe58262508f5f9804ecc1a47553c345ad81405e9f68799d0a331b848e788063222ab
SSDEEP 192:npyW5EtxEg1zfVDWBcf7oiRwDDroNgql1oynOhusqIEv1zGEwHG28xYzZdhTjJ:nYRpfgBcDZG3snl1YgdzQG28xYzZzTt
TLSH
T1458208392FEA5EB1D3B7CAB608F7D3D58D39B022BA435B0DE5402B4DC82B142D854D98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2956	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_67f611defd7ecdf74c5125ba2758cd0e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2956	2556	2026-08-20_67f611defd7ecdf74c5125ba2758cd0e_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_67f611defd7ecdf74c5125ba2758cd0e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_67f611defd7ecdf74c5125ba2758cd0e_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 17KB
SHA256 3fc4cfb041580de8802d9945a4e04a4eb389da20b19b72732ccf72a2a5185bf9
MD5 e891f3c447ee414d813bc41c26b46599
SHA1 a6865fba72f2c4ef70c0e895c419dee05cd7a87c
SHA512 66dc97d214eea49cfae3249c073d1206b2ea279faa8a8cf5e647f0e3a228a9b21ae98df3e6aca3a2468a97c58ab4925135022db80216f5b2ee9b7172ff4a7f23
SSDEEP 192:npyW5EtxEg1zfVDWBcf7oiRwDDroNgql1oynOhusqIEv1zGEwHG28xYzZdhTjN4:nYRpfgBcDZG3snl1YgdzQG28xYzZzTp4
TLSH
T1BB8208396FEA1EB1D3B7CAB608F7D3D59D39B032BA435A0DE5402B4DC82B142D854D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download