d6edae625715556162202b571fb4269f3e119b774d27e734ec7d2e1e164e5125

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_47f92f0129e0c908caf664d78e97a756_elex_wannacry.exe
Size 32KB
Sample260821-e9kbrashqe
SHA256 d6edae625715556162202b571fb4269f3e119b774d27e734ec7d2e1e164e5125
MD5 47f92f0129e0c908caf664d78e97a756
SHA1 7dfafefdc7048baea013fa240e8db73349c509b3
SHA512 2ea6818efa44336e10324e87e9c748dc581d4afdc62422fe11fcf6ba7ad1edd616c81ff2de3acde04250432bd2e2c97dc41b2c9764861db7b220e15b8da21b53
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o9Yy5tY:Kz2u4LJjBaECkLSi7xsYhaKDViw35tY
TLSH
T114E20B389BD559B6E377C6B6C8F2A5C6A932FE2275111C0E508633400873B53BEE2D5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-08-21_47f92f0129e0c908caf664d78e97a756_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
5124	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_47f92f0129e0c908caf664d78e97a756_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5124	4732	2026-08-21_47f92f0129e0c908caf664d78e97a756_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-21_47f92f0129e0c908caf664d78e97a756_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_47f92f0129e0c908caf664d78e97a756_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 33KB
SHA256 b49eba65aaebdbae5e3ed6a8b8305cede3b60d1d4d86daba5cd2291c42184d7f
MD5 373fb2487b33719bed80a9f0ea6138e9
SHA1 3ed4f2f34c120ffdaf39311c5c79ce8a3abf6b23
SHA512 75f38a31af82c92f8622e14d6a3d1add9651e3bc24c5a40d8cb13b51e4aad9d0f49799d76b96eb147e46126cd48395f367351b33cac00cf95eb2388ed267a5ff
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o9Yy5tp:Kz2u4LJjBaECkLSi7xsYhaKDViw35tp
TLSH
T14AE20B389BD559B6E377C6B6C8F2A5C6A932FE2275111C0E508633400873B53BEE2D5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download