waski | 2db3f0da13e138d8c0c3fd52ddf98ada0184f84971ebf8d52b232a3bd8cfa26a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_000af18397adc16c76cb0b2de124a96a_elex_wannacry.exe
Size 15KB
Sample260820-tkcmyatzat
SHA256 2db3f0da13e138d8c0c3fd52ddf98ada0184f84971ebf8d52b232a3bd8cfa26a
MD5 000af18397adc16c76cb0b2de124a96a
SHA1 a0317eec5fb1629a6d12d9fe13737013c6a44918
SHA512 0a2b20dd987a1b806bc26c4cc26e69c95ae479991c107d9b9ff05447aa68e9d1a0cdf7e088a7d3a7e585e96496e1faa8be7a735787c34340c949b59a9d328e43
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGih1I87fGZR3e:uTQWckBeEd6ml1pcg7F3Gih1df234d
TLSH
T11A72B7355AD11DB3E3BBD3F685FBC1D69825B02F67035A3F90492F892923A119C90E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b853-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
3804	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_000af18397adc16c76cb0b2de124a96a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 3804	5772	2026-08-20_000af18397adc16c76cb0b2de124a96a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_000af18397adc16c76cb0b2de124a96a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_000af18397adc16c76cb0b2de124a96a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 15KB
SHA256 0225403d5b7d58fb74cf753d0dc5d7c8c097109c5f688f90342aa4db56ac39f8
MD5 4f81b3cc19759a503a2eacd16491e2ed
SHA1 dd1f7b089f8337acf51d00e3e379aed05b35b5f8
SHA512 238bfd511771290c1dd6efa508c388874e6ab0d84e282d7ac76fc96b4a443a6ef5ed6b426c803a075187b3010ac5a85f09d4b68735dcb1c9c593088a28350c0f
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmg+jjGih1I87fGZR3g:uTQWckBeEd6ml1pcg7F3Gih1df234P
TLSH
T17C72B7355AD11DB3E3BBD3F685F7C1DA9821B02F67035A3F90492F892923A119C90E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download