a95b6b983396c86050643872c0829f83884080847434e96e66588ce9640a3773

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a82776e892ea0bf26d76805c4654fb3b_elex_wannacry.exe
Size 23KB
Sample260820-xkmppatela
SHA256 a95b6b983396c86050643872c0829f83884080847434e96e66588ce9640a3773
MD5 a82776e892ea0bf26d76805c4654fb3b
SHA1 b02447852bc00574288e3923065ad441e22b6dfc
SHA512 9ba72a49775b62b64c8e347922ff76bed8bdba3e0e432b5fc5809d2819d5c73a1dd5c9f0f811457a078e80032cf01d8d5f82d883635391ea71a8a7748c8fa98e
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mHOCS7K:d/3xd1HXzoy44hXPux7K
TLSH
T12CB211B59BC20DF5D633DDB9C4B2A5C3A553F16EB9165A0D44C22F062F13342A8A2C8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5032	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a82776e892ea0bf26d76805c4654fb3b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 5032	6128	2026-08-20_a82776e892ea0bf26d76805c4654fb3b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a82776e892ea0bf26d76805c4654fb3b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a82776e892ea0bf26d76805c4654fb3b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 23KB
SHA256 aed7cca7af16560761b17881bf46aea53ccba5d883b317490fa4bbc8b1974864
MD5 e9ee30d9f6a430a486fc8aba0e01346e
SHA1 ee311f672b3a7f32492778c60c9fc2c19bac177d
SHA512 e5891996e71586c8d026c4b36a715a8fcbf045ef126f13828a721eaf73e435542176903650f5bc6e77b8d8a93b46a50c790c5541a6a1e1b688857903968d508c
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mHOCS7q:d/3xd1HXzoy44hXPux7q
TLSH
T18DB210B59BC20DF5D633DDB9C4B2A5C3A553F16EB9165A0D44C22F062F13342A8A2D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download