0737d0224c62f911a2cb7b6255e817fd5b3f6174fc2b11410baa71a04bbe0112

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_4b576530706b3f612878b8ad7f4460e8_elex_wannacry.exe
Size 14KB
Sample260821-dk4tesfn2t
SHA256 0737d0224c62f911a2cb7b6255e817fd5b3f6174fc2b11410baa71a04bbe0112
MD5 4b576530706b3f612878b8ad7f4460e8
SHA1 53e4fa3f87eb3fada247f9d7e12741c5df14ace1
SHA512 d196481f5a95e30da49e0ee7b9f7f20cce55a0f73600c58a5c54fbc7e9bdf173acb7331fdadabc2945a0c2076a5c3b0ac125e762e244f3ae089e8cbb654c39f2
SSDEEP 192:uudEiE4k1kb63G1RqiJcv8uPM4NT2rp0gQ5BhXHrjql1oynOAqusqIJ7j3ey:I3d1kbT/qPbErCB5BhXHil1YYO7j3ey
TLSH
T116625C9AAF919C77C377C934082BA2F89F19740237A21C9DCB51358ADD2E6E3CC4A145
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4144	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_4b576530706b3f612878b8ad7f4460e8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4144	4544	2026-08-20_4b576530706b3f612878b8ad7f4460e8_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_4b576530706b3f612878b8ad7f4460e8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4b576530706b3f612878b8ad7f4460e8_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 15KB
SHA256 1a555a1ef9ebeac5c1b30ab1208eb0943ba8e041478a4698d8de8119715cd0d5
MD5 7598794cea9a523a36448ee24e66db28
SHA1 06f9cc05fd4e45cbbc370bf44cb5acdc9e26dbd4
SHA512 a1594afef07e8617386a6a4522c3ab631b6f0289944acdc2bcac6d3b4476ed9a0ab898c60af27f958691e4f2d0d68aa6c85f05edb20b52dc0970e58208508aea
SSDEEP 192:uudEiE4k1kb63G1RqiJcv8uPM4NT2rp0gQ5BhXHrjql1oynOAqusqIJ7j3eD:I3d1kbT/qPbErCB5BhXHil1YYO7j3eD
TLSH
T1E5626C9AAFD19C73C337CA34086BA2E99F19780237921C9DCB51358DDD2E6E3DC4A109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download