be950d499cd2bd4c843f2d222d940529fe8aecb3f140642fde2a95b8325ac4ea

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f25440b2d3717204b2dcc035b2b61bee_elex_wannacry.exe
Size 22KB
Sample260821-eaxg2asbpd
SHA256 be950d499cd2bd4c843f2d222d940529fe8aecb3f140642fde2a95b8325ac4ea
MD5 f25440b2d3717204b2dcc035b2b61bee
SHA1 c38b16259ba0b0f980469ca7be70f3c62b7d3632
SHA512 40e1b31c2bc851e9c1aea45a7e305c732dc6975333645e506669d41437495bea129cfad9d7184904c40f92652c000975e8fcb32adc4bd4f440cd711e8e471616
SSDEEP 384:JVs9GWh37NpzYH/ISm6g8l14ZqY09q/4soa5HTlMFQx0X:JVs952ISmO6v4soa5hBx0X
TLSH
T103A251799FE8A533D3BB8A7589F565D2A930B46B3F02581E00C2078C4823F97ED5175E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5660	codecupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_f25440b2d3717204b2dcc035b2b61bee_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 5660	4468	2026-08-21_f25440b2d3717204b2dcc035b2b61bee_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f25440b2d3717204b2dcc035b2b61bee_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f25440b2d3717204b2dcc035b2b61bee_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
Size 23KB
SHA256 1d8312763989552ce9a5b6b3aca51440247ea0557d9e1a3b0fce2efd51455340
MD5 f430b69016364553a3bf0c5ed3c639d3
SHA1 4af2753ed6bd295786a6c827545d58b2dc45f23f
SHA512 12e5d9e223e0e3dd1a74609a9034228f8c8fe12616cfc6c9ea917fcdd3b270b8a01eeb0c588695ce14dbd92ed48cfcb1114707ccbea19c132cdf45a9e240a3b4
SSDEEP 384:JVs9GWh37NpzYH/ISm6g8l14ZqY09q/4soa5HTlMFQx0O:JVs952ISmO6v4soa5hBx0O
TLSH
T1B7B241799FE8A533D3BB867589F565D2A930B86B3B02581E00C2078C4823F97ED5175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download