aa51fa0651e79d7f9311fe97d29446d7d10622b94fac372113f49f57eba6d90b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_7b990cd167493c63f2c9cf9ba73dfbbc_elex_wannacry.exe
Size 52KB
Sample260820-v7zawsgl2s
SHA256 aa51fa0651e79d7f9311fe97d29446d7d10622b94fac372113f49f57eba6d90b
MD5 7b990cd167493c63f2c9cf9ba73dfbbc
SHA1 75c994029097067294ae691256b88db1e648f040
SHA512 6e15b7a9b41048778dc090cb86b36794ea1922337be70047022ef3d830eafad0fc86f7a9412e6892367d3908fd4f1db51c3ea2426916da8cdab4d655f57807ad
SSDEEP 1536:Kz2u4LJjBaECkLSi7xsYhaKDVSYTjipvF2mEn:KS8ELSGSYvQd23
TLSH
T17A330824F7D598F6E2670236887595E11132BE21BDB0092F3C56330D1CB2E52ADA6F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1292	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_7b990cd167493c63f2c9cf9ba73dfbbc_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1292	4528	2026-08-20_7b990cd167493c63f2c9cf9ba73dfbbc_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_7b990cd167493c63f2c9cf9ba73dfbbc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7b990cd167493c63f2c9cf9ba73dfbbc_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 52KB
SHA256 0006f4f84f9784cf96b2588b48ba874def070e472ddcf02e8135cfcb0d5fec94
MD5 90e5fe9e4fc795e539ede2ba8afcb782
SHA1 8d4c10fbb295815b243064a44ffdcbbebccaa89b
SHA512 fcb7fbb8f45b030835e168b0953989ceec880d3fb957eedb530492634840e642806c83a2a531349a52809969848d67fa2f4ae7cdf8976e53c1fa9b1f45e2c0c2
SSDEEP 1536:Kz2u4LJjBaECkLSi7xsYhaKDVSYTjipvF2mEr:KS8ELSGSYvQd2b
TLSH
T14B330824F7D598F6E2674236887595E11132BE21BDB0092F3C46330D1CB2E52ADA6F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download