2d02afe1d83c42d5f622a00133d478c740f496e01c14d835cd8efbbeb826a9c2

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_63c9f547333740556f624bca21f371f1_elex_wannacry.exe
Size 22KB
Sample260824-mcwyaach84
SHA256 2d02afe1d83c42d5f622a00133d478c740f496e01c14d835cd8efbbeb826a9c2
MD5 63c9f547333740556f624bca21f371f1
SHA1 0a73b944f6bc281b879bf7a1b89219a8b2e21c47
SHA512 4ca4d1cd862ca2f7c4d9c1d57bf60ef6a1576239971525864093820cf465b912352ae4e1a4c34c9d36f8c7e435e781fed41baf8c3204919dea1131553fb4c9ab
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzsc8dTrkFnC4C:f9hM2dB4XAGZ7sc6HEC7
TLSH
T198A26138EFD846B2E33BDAB54AF695C66972B0227D06690D90CD73440C23F56EC60B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-23_63c9f547333740556f624bca21f371f1_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3304	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_63c9f547333740556f624bca21f371f1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3304	4284	2026-08-23_63c9f547333740556f624bca21f371f1_elex_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-08-23_63c9f547333740556f624bca21f371f1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_63c9f547333740556f624bca21f371f1_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 22KB
SHA256 cf7bedd560d9f70f7da307d2bbffdb538013c838e24812ad6775a0023f899e29
MD5 b53a51d95777cc24c286cc4fdb61a68a
SHA1 4732be8c12b2515a7ad5f493e63a63ca8c1021f5
SHA512 f9d7c9654612c5f44b8fead607fb0553e0036c0ab1cbc2ded27b3238c78011bb4a313b2795f6cf9b0495e07b8b87b2bf8e12f24d905d2e22c9ddbfdc7b190355
SSDEEP 384:ulis+wQ7rmUMGid0Z3Nbe1xFCiCGZfzsc8dTrkFnC4F:f9hM2dB4XAGZ7sc6HECY
TLSH
T170A26138EFD846B2E33BDAB54AF295C66972B0227D06690D90CD73440C23F56EC60B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download