3d12e2de84099c2c3c747b5aa4422593579896ac855000c8dea235b5584f09a3

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_aafa18ace05222e94410c49376bf0e70_elex_wannacry.exe
Size 34KB
Sample260821-bzx83stybv
SHA256 3d12e2de84099c2c3c747b5aa4422593579896ac855000c8dea235b5584f09a3
MD5 aafa18ace05222e94410c49376bf0e70
SHA1 7e05d97e2d8f355fd6ca1cbb2f27060d42c0d510
SHA512 070725a8904eb6911679336a5621d68a3397fc964c1c86d00c433a91d323799bed73618aebb368c0b24a30f4165e866c395f85951f64f11991754b8013ae1c68
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbiUzZBX9vWrd4xzlWpH6:Kz2u4LJjBaECkLSi7xsYhaKDV4UzZb8s
TLSH
T109F2FC389FD559B6E377C6B6C8F2A5C6A831FE2275121D0D908637410C33B43ADA2D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3284	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_aafa18ace05222e94410c49376bf0e70_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3284	3064	2026-08-21_aafa18ace05222e94410c49376bf0e70_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_aafa18ace05222e94410c49376bf0e70_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_aafa18ace05222e94410c49376bf0e70_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 34KB
SHA256 3018aa148d2411f98d308fcf17fc224081349d435a9be9eec4f2ea6eb24c9e13
MD5 ffb8334d8ef5cff06ffe2a8e90bfa3c9
SHA1 d47c8156551ec69f2cc2356dd07d3e857c6049b4
SHA512 8b63d4fb274296e4e12686b50d824bc82d089064ad530ba283659f11e2017ada6a062db4b0dcc20fc5f145799b6e861aa2bb4311d7eb35b38e997172cd93f49d
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbiUzZBX9vWrd4xzlWpHU:Kz2u4LJjBaECkLSi7xsYhaKDV4UzZb8y
TLSH
T125F2ED389FD559B6E377C6B6C8F2A5C6A831FE2275121D0D908637410C33B43ADA2D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download