91480c006ce2357f9790cf8bd21bf6073bfbdb8d3906e3cb0a21ae1f5d257c40

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_ca5e8844b0f5835c3fdd481a17da9aaf_elex_wannacry.exe
Size 15KB
Sample260820-xf3v4stdlh
SHA256 91480c006ce2357f9790cf8bd21bf6073bfbdb8d3906e3cb0a21ae1f5d257c40
MD5 ca5e8844b0f5835c3fdd481a17da9aaf
SHA1 7095c20629905e9a3c3e24c06f4ba025bd9c4e82
SHA512 31b5cb1e0f6e8ca506839431fc98af882248368c8ebaec7275617486f4e9bc01a857c203b2e859519eacce5866eb548973093ea92def172a4fbf506199fa5651
SSDEEP 192:npyW5EtxEg1zfVDWBcf7oiRwDDroNgql1oynOhusqIEvdq7+MY:nYRpfgBcDZG3snl1Ygy+MY
TLSH
T155725B2A6FE91E71C3BBCA710CB793C58E2D75227A436E0EE610358DC92F143DD58948
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1212	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_ca5e8844b0f5835c3fdd481a17da9aaf_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1212	1496	2026-08-20_ca5e8844b0f5835c3fdd481a17da9aaf_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-20_ca5e8844b0f5835c3fdd481a17da9aaf_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ca5e8844b0f5835c3fdd481a17da9aaf_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 16KB
SHA256 a747924f4f6047f76ff794e126786f2cb8e1ba25566c353e1d6ac7aebe4e21d0
MD5 c4625226d42b1bd1d6eb52b60bbe8b12
SHA1 ebfcdd2082fa1179f28340af84e7b7354337085f
SHA512 1c9e75c73ae81768cd34d7c5b589ac95294bc142fa4607fe6b41bb802977e4944054e486a43fa869b2ff6dc6bd09e6d0da54f6d23845d21bb0c45a5a1011b3fc
SSDEEP 192:npyW5EtxEg1zfVDWBcf7oiRwDDroNgql1oynOhusqIEvdq7+MD:nYRpfgBcDZG3snl1Ygy+MD
TLSH
T118724B2A6FE91D72C3BBCA710CB793C58E6D75227A436E0EE600268DCD2F143DD58948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download