waski | 5e2f0c663c0bcfbc17a98e94389fdc1c8a0a3aa3cc66b5b1c6a8c126e209001e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f4de14b064d0937e94c037cc6a92f62f_elex_wannacry.exe
Size 16KB
Sample260821-plergazeld
SHA256 5e2f0c663c0bcfbc17a98e94389fdc1c8a0a3aa3cc66b5b1c6a8c126e209001e
MD5 f4de14b064d0937e94c037cc6a92f62f
SHA1 c54980794e93ee618ccc596504536d09b18fa308
SHA512 355c66290182999b93782c7a92531dc9876e76e91d016a501a912601f8b67a941cae0dcbc15a2c5ea93c4973b82f9ec643098f99fbc64656f504fbc3121493eb
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmtBUPN2Rp8Jim5Trsp:uTQWckBeEd6ml1pcg79UP4EJzZsxPH
TLSH
T16472A4395AD40C73E3FBC3F581F7C1DAA861B42B37035D2E94852B892D23B12AC9169D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b867-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
5376	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_f4de14b064d0937e94c037cc6a92f62f_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5376	4868	2026-08-21_f4de14b064d0937e94c037cc6a92f62f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f4de14b064d0937e94c037cc6a92f62f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f4de14b064d0937e94c037cc6a92f62f_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 16KB
SHA256 88cd7d429de31d2bac476561d583ebf3ced94818dbaa414f154f803e5aeb754f
MD5 a1c8193995c0f76499a6ac1920b852b8
SHA1 d038380dd2f7cf73d4e8e7864b07972e5fd90b22
SHA512 48df1d50f4562fa52e99125f58e60cd991c0872453b784436911659960edf7f0a432f691c1ac02c1ad2af9cf0d6e009718cf2d4f86e8a9786cd655b64f733606
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmtBUPN2Rp8Jim5Trsg:uTQWckBeEd6ml1pcg79UP4EJzZsxPq
TLSH
T1DA72A3395AE40C73E3FBC3B581F7C1DAA865B42B37035D2E94851B892D23B12AC9169D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download