62d671081352d68d3659d2c93867bf1042f04b4f36a14fa4cd0c1ea6d8cb889d

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f98973aca31640f46a8d0889d890f583_elex_wannacry.exe
Size 47KB
Sample260821-ckwblseq7w
SHA256 62d671081352d68d3659d2c93867bf1042f04b4f36a14fa4cd0c1ea6d8cb889d
MD5 f98973aca31640f46a8d0889d890f583
SHA1 df4ba4bc4eae9958365a8e4d64ae7f5655d9e70a
SHA512 74d8ad838f3d04ff9e2c7a22633a3f0622edbee9f4134878768dbcd3578f37e9b49fc33572b4963dce0c71e7a69c0b9bbbc756840dcf2479f77aeba971fa5394
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwJ3svr:nAYTjipvF2bQ
TLSH
T1AE23192A7BD198B3D2BB433544A641F5AA367C527DB0462F3D82338DD872E61DC49B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4100	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f98973aca31640f46a8d0889d890f583_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4100	5780	2026-08-20_f98973aca31640f46a8d0889d890f583_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f98973aca31640f46a8d0889d890f583_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f98973aca31640f46a8d0889d890f583_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 47KB
SHA256 7a182b728bab2391914c221fffa921250be9054e8ae111880479d8e9dd616dbe
MD5 ce72e7a138fc4c6f84551cd6d60d9921
SHA1 0f97a93187b688f7ec08519162f68e0141dac673
SHA512 7080b05a6dd593ffdbc6858a193cecfff266743a4bbe4aae8dc98880de1820b70ecf7ddf958d300e4d1b1b3569007d6da550a158ad2a9357b430949a6852500b
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwJ3svN:nAYTjipvF2by
TLSH
T1892319297BE098B2D2BB433544B641F5AA367C527DB0462F3D82338D9C72E61DC49B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download