bd935ff93842c8f9feb9450c864dd63658d6c1a729301b3aad641b0b56889aa2

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_ab6f40a0bbf47f21dcef74b777fe41c1_elex_wannacry.exe
Size 70KB
Sample260823-dbne3ssbnd
SHA256 bd935ff93842c8f9feb9450c864dd63658d6c1a729301b3aad641b0b56889aa2
MD5 ab6f40a0bbf47f21dcef74b777fe41c1
SHA1 07ec01cfa1c608a98d4f2f64d400d1b196ce9667
SHA512 aa07c0af1cc972d9f239c97bc3e3c2a1e0b444fb687c0df2a2dabf9190848c4f07c625baf0d3be7f4aceb335f6d5447bcd8c6b2d18a915ac2ca577bf91303bee
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJr9t:D6izaOIUYTjipvF2nSO9t
TLSH
T1A763282ABBD55672D3B7477144B640E2BA3ABC223EA1491F3882334C4833F65DD65B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3476	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_ab6f40a0bbf47f21dcef74b777fe41c1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3476	1512	2026-08-22_ab6f40a0bbf47f21dcef74b777fe41c1_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-22_ab6f40a0bbf47f21dcef74b777fe41c1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_ab6f40a0bbf47f21dcef74b777fe41c1_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 70KB
SHA256 cdccc9ec72595c1ab3321b88b64702b42a884ea526361298240138e055d23f86
MD5 bd6f2cef78622bdac4cb0861ff167640
SHA1 89d86fdbd19d862d63282d9d928d57e79759b619
SHA512 6c3980d4d4d9f177791f874c676a21d75b1eba047a1a8ed0fafde0e753ac102ce581082f479bb44d96046729cecc096fdefd214ccf76d8a2f669f395872cff1c
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJr9d:D6izaOIUYTjipvF2nSO9d
TLSH
T13F632829BBD55672D3BB477144B640E2BA3ABC223EA1491F3882334C4833F25DD65B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download