8d098a209f906aff0c9f328da2d369660e94c23ce88868f1b792ed1e8dfdf25f

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_9152d476680547874f520706e726db3a_elex_wannacry.exe
Size 18KB
Sample260820-v3e2fssckc
SHA256 8d098a209f906aff0c9f328da2d369660e94c23ce88868f1b792ed1e8dfdf25f
MD5 9152d476680547874f520706e726db3a
SHA1 8d537bb5fe860a1b65a7ba19de062516a179b42e
SHA512 9f900b3601b54d6b5e002de13d181547b798a8387a4423671eeafd0a92d4105f738c8943228ebcef691afd803575d782f7bab8b6b40cc3f7ed6c53d78f41587f
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFDouyUb9w:1NIlcanKw9hBOUb9w
TLSH
T14D8283396FD60EB2D373C5B289F7A2DA9932B823B9031A1DC49D17059C03B53AD81D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5320	ieupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_9152d476680547874f520706e726db3a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 5320	2932	2026-08-20_9152d476680547874f520706e726db3a_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_9152d476680547874f520706e726db3a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9152d476680547874f520706e726db3a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ieupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
Size 18KB
SHA256 684c6dce171f2eaba683690e94714cb6968555dc70d9afc1e26f80980b29f53a
MD5 90cc0e2dc10a230959800350dfa28a76
SHA1 0cd6cd99cc94a4dd01a7f8f48ef2024f04eae664
SHA512 1c911aae2e0322d71dc65419f10570ddbed17056c1ccf71c0e7df32c4b17a376ebd2c504528ef56ad2e2befe4ec05ab65d12553496390a95d3bd666129d3fc1c
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFDouyUb93X:1NIlcanKw9hBOUb93X
TLSH
T11A8282396FD60EB2D373D5B289F7A2D6A932B823B9031A0DC49D17059C03B53AD81D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download