4458bb637c83785219ad7f5fb9d9d287e9deb0e41590f6bbdbdb6b8959c6784d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_db963b6094cf09a99196a00f8cb2a921_elex_wannacry.exe
Size 22KB
Sample260824-2xebasfc99
SHA256 4458bb637c83785219ad7f5fb9d9d287e9deb0e41590f6bbdbdb6b8959c6784d
MD5 db963b6094cf09a99196a00f8cb2a921
SHA1 e551dd273cbee9bbb60af9281f95bedb67f591c0
SHA512 58d8f9d93dfde3728bfa7b23309515791d79d41ef47f9ee64b17a73f44dd463c91b1450edab9b1fff865fc2b9007b297696cd9edd8d0fbbe9d4c934dd707b2df
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+W1PPt+apsa:d/3xd1HXzoy44hXzBpd
TLSH
T1A5A230F59BC109B5D633DEB984B279C3B553F16E79165A0D04C22F026F23343A8A298F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4256	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_db963b6094cf09a99196a00f8cb2a921_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4256	3956	2026-08-24_db963b6094cf09a99196a00f8cb2a921_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_db963b6094cf09a99196a00f8cb2a921_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_db963b6094cf09a99196a00f8cb2a921_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 22KB
SHA256 31b5ffd7498c9558f6348bfa13f322158cc753c9c28d5e75c1098387d1467d70
MD5 aebcf025f811ac5f83e0aca3eb3041f4
SHA1 9621b7340e95102651f7f98865deb65acbef6a49
SHA512 40e39955f3c06f08c27d527abce5d4d223ff19bc8436ada39ce5742c1b802255dbb0d1d6c05750399fd4d6d23bc034b489a45b4a765a5b398b6cf4f290567912
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+W1PPt+apspb:d/3xd1HXzoy44hXzBpeb
TLSH
T11FA231B59BC109B5D633DEB9C4B2B9C3B553F16E7916590D04C22F066F23343A8A298F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download