waski | 4ef334dc557ec0efa5619ab265b47935c5823a9589f05b1fa54420424fc59521

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_8ea256ba508c36523da5c7ca6db708b3_elex_wannacry.exe
Size 31KB
Sample260821-mnhvsscp21
SHA256 4ef334dc557ec0efa5619ab265b47935c5823a9589f05b1fa54420424fc59521
MD5 8ea256ba508c36523da5c7ca6db708b3
SHA1 d173390bbd692c153dd24eb7183a4aebfc3f4c86
SHA512 698ed04374e1ea6c895e99b04dd787261cffb102a9ea5200cf9869252f8ef923730aa0608b4ddb4260e9897562872f9eedeed1e2c4f096a6bd99accd6bc6c041
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsIo:uTKWckBeEd6ml1pcg7eMUUz62+
TLSH
T133E263346BE45D73E3BBDBB586F7C1C5A975B42A2E03992E80451B881833B11DCA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000006977-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
4504	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_8ea256ba508c36523da5c7ca6db708b3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4504	4564	2026-08-21_8ea256ba508c36523da5c7ca6db708b3_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-21_8ea256ba508c36523da5c7ca6db708b3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_8ea256ba508c36523da5c7ca6db708b3_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 32KB
SHA256 2a3eb1932900bf854a61371eb1dcd48dd695d2ce6d53d059db6022c5c1b36369
MD5 1d45b3598abc299aaebed23b06530372
SHA1 1cf57ebdf23dca6b18c30c6d447dfcd28c30f9e7
SHA512 7ad5ffb2091c24e1e9055636926095be8cec356ebf2d92eed6d9e6e19212fcfe77918cd11b9111390a7a433a776a92c0ed0e6fb8ae7ba8831d1e80dfe4255209
SSDEEP 192:uTq5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmAKLCAYV7/mjmTUsI+:uTKWckBeEd6ml1pcg7eMUUz62o
TLSH
T1ACE262346BE45D73E3BBDBB586F7C1C5A975B4262E03992E40851B881833B11DCA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download