waski | 3155d3423b12ef00d812880671a0800595d30265fdc8e1c26110292d259902dc

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_ffcc49c4ecfb080d94ca6176c0c601c7_elex_wannacry.exe
Size 20KB
Sample260820-yqzrwavanf
SHA256 3155d3423b12ef00d812880671a0800595d30265fdc8e1c26110292d259902dc
MD5 ffcc49c4ecfb080d94ca6176c0c601c7
SHA1 52e3920ee4618bab1ea0230681af76adfc56da98
SHA512 565ce50706812640d81cc8b16d69e4e267b75206dc320617d04c3ed206867741d306514b82114fcc8d68e8cc2f57a91648234fa66c5df31c3e683dfdc5533d9d
SSDEEP 384:uTQWckBeEd6ml1pcg7F3Gih1uTRTcljilermJiMiA2r7t:uxckEEd62J7F3Gih1uTRTcljilViM8rh
TLSH
T1B69241395FE41DB3E3B7D6B685F7C1C6A830B4273A03591E40861B891C23F12ADA1B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000011394-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
5504	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_ffcc49c4ecfb080d94ca6176c0c601c7_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 5504	3672	2026-08-20_ffcc49c4ecfb080d94ca6176c0c601c7_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_ffcc49c4ecfb080d94ca6176c0c601c7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ffcc49c4ecfb080d94ca6176c0c601c7_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 20KB
SHA256 3dd8561e6c9eaebc15e6f239af22281fc3a405a807bbe0fb93aba113007c9cda
MD5 3e30612de3b1f9bddd0cf61c0fa9ed02
SHA1 2f1e258dfd12b102295f93846d0c2332605fcd39
SHA512 7f42f3c21400e0841169895f832f494c5f4d6e5fa4e915a4bc6403691a9b57f9851b803220b5aee1bd3eb7735dc817815e4186e25237cd265eaf3c2773dd9b7f
SSDEEP 384:uTQWckBeEd6ml1pcg7F3Gih1uTRTcljilermJiMiA2r75:uxckEEd62J7F3Gih1uTRTcljilViM8rF
TLSH
T1219230395FE41DB3E3B7D6B685F6C1C6AC34B4273A03591E40861B891C23F12ADA1B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download