ea0b639a2e0c0919e1d74eee87ae56871d580d9efc552a2dc2c41b3fea50ddd7

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_113345c55e217ae8814cb78de34bf46e_elex_wannacry.exe
Size 20KB
Sample260820-qhnewade98
SHA256 ea0b639a2e0c0919e1d74eee87ae56871d580d9efc552a2dc2c41b3fea50ddd7
MD5 113345c55e217ae8814cb78de34bf46e
SHA1 faaf742f854c2e21cc74fa303d0805be83e8d4ea
SHA512 9f5b93a06e1b2ed67b9b2c5f28ff4d39b36f940d71eec9c2f992683a97afae3c3a368da0ba91ad3b0f94e21fa13d4ffc16598c9b28fcf96c896ad4c424b45f20
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0Rd3PnA7hjGeKnhe7d0MT1:nYfoKSs71dv4/0073PnAQo7eMT1
TLSH
T1C592B33D6FD61EB2D3B7CAB688F392C6ED25B02375025E0DD48217898C17B42AD8498D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
256	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_113345c55e217ae8814cb78de34bf46e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 256	1032	2026-08-20_113345c55e217ae8814cb78de34bf46e_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_113345c55e217ae8814cb78de34bf46e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_113345c55e217ae8814cb78de34bf46e_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 20KB
SHA256 cb4ac3dbc2aa228318124e51ea563f1fedc8b407ecdc1dd2161e71eccc990fea
MD5 0df52c05008a9da4b59b829c3196434f
SHA1 b90b61b8b705959c8763e8f20de1f42b7ae2fa36
SHA512 7fd84cc15dfcc72d48a5c2b600628cd4f6d853c643b2c7368d246d5848fc1bbe6f4f6c2f37ec0a82326e53a132f3400d8950e271decdf11838caf7e5a7a3e7b0
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0Rd3PnA7hjGeKnhe7d0MT3M:nYfoKSs71dv4/0073PnAQo7eMT3M
TLSH
T1A292B33D6FD61EB2D3B7CAB688F392C6ED25B02375025D0DD48217898C17B43AD8498D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download