b0a452f01aeb6ddc1be7cf2562e59cbe3d949871179e9c0ca47ea9e43b7a846c

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_0645e4e85688f7871e0b0299f992d23e_elex_wannacry.exe
Size 14KB
Sample260820-wye2bsfb88
SHA256 b0a452f01aeb6ddc1be7cf2562e59cbe3d949871179e9c0ca47ea9e43b7a846c
MD5 0645e4e85688f7871e0b0299f992d23e
SHA1 05987df4303bec9627291236dd7932e934c81ce3
SHA512 4261ae125644e2ac37dc1f976e3952358ba61f29a3409104f2f0c3ec0f31e2ca0d25c16d0859ab2fd41e72632d1ee2e9c53744ea215b1c5e18eebcce9729d2b9
SSDEEP 192:SjIuVoh8tbeq6kbkxKoPIyUMoFl1oynfJP2Oh+AOQOBJbZBEW1QzL:SjIAaIbL6kbkxRIyel11RlPOBJrXkL
TLSH
T1DE62E82B5FE008B2D373853895BF74CAAA79382276129D1D98903299CC52A23FD3475F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3412	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_0645e4e85688f7871e0b0299f992d23e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3412	636	2026-08-20_0645e4e85688f7871e0b0299f992d23e_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_0645e4e85688f7871e0b0299f992d23e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_0645e4e85688f7871e0b0299f992d23e_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 14KB
SHA256 beabf97650ec9f11d25ae1e1c2aebe2e1ddb9f4bcceba4672e7c544dc4a93b32
MD5 f52cdcd1deba8c3e8b5ac6624b085845
SHA1 25ff878800221909ffb46cc8410dae4d6628bcbf
SHA512 de0df9129a0a39374efbbef6fd8caad437b5a397fa0a03974fcc249d705fd3716d775e26e2c7f4796793928351b38d943c6c9f413990609be25b09af49e92d50
SSDEEP 192:SjIuVoh8tbeq6kbkxKoPIyUMoFl1oynfJP2Oh+AOQOBJbZBEW1Qzn:SjIAaIbL6kbkxRIyel11RlPOBJrXkn
TLSH
T14262D82B5FE008B2D373857895BF74CAA67938227A129D1D98903389CC52A23FD3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download