ed1f39b003b052444d70792f2a9a50233bf99c94932b8e774b8ee3ebb6ca2347

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_dae43263d72fe313019053fba8f95c25_elex_wannacry.exe
Size 18KB
Sample260820-xerrfstcrb
SHA256 ed1f39b003b052444d70792f2a9a50233bf99c94932b8e774b8ee3ebb6ca2347
MD5 dae43263d72fe313019053fba8f95c25
SHA1 95b8706653609a4475001fe1a2438c1aef721cbe
SHA512 6d21bb056aeeab054c3d923dc503bab52c675bb9d836a010838645b7f6e6359e0c28a8b157307f2afab92c046c2a98a4e6ccc388ad47f7c1a5125f2ba010af23
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLytR:d/3xd1HXzoy44hi
TLSH
T1B29263F2978108F4D4239EB9C4727983A153E15EAD2A9A4D08D27F067F23353E46398F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-20_dae43263d72fe313019053fba8f95c25_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
4700	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_dae43263d72fe313019053fba8f95c25_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4700	2740	2026-08-20_dae43263d72fe313019053fba8f95c25_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-20_dae43263d72fe313019053fba8f95c25_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_dae43263d72fe313019053fba8f95c25_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 19KB
SHA256 5da358da27f23a166e387067fd6743326e17a8bfc2aca8580cf4164049ce6ccd
MD5 19706c5a432bbe5bc9e628731e813cbc
SHA1 79132ae7e85d73a087fce1cc749ac1a87e94f02d
SHA512 870443aeb6202fc391a5123d5d960ba1f6a719e90b51c0e65b8951246acc9b63506506c71d55d3ed9500a064cd3dbb8f9b40b976fffe9da46b6c2612e8efc4b3
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLytt:d/3xd1HXzoy44h2
TLSH
T1BF9262F2978108B4D423DEB9C4727983A153E15EAD2A9A4D08D27F067F23353E46398F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download