a859b154d714dbaefd3845ce6e536afc0dc6c7022e5c5efd1a0bcd00038a4782

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_145b9acc8fe2560af6a268bff5cad7e4_elex_wannacry.exe
Size 69KB
Sample260824-vbvyla1bqd
SHA256 a859b154d714dbaefd3845ce6e536afc0dc6c7022e5c5efd1a0bcd00038a4782
MD5 145b9acc8fe2560af6a268bff5cad7e4
SHA1 e14ff1c4a8054d22ea1cb98b8387fb5e747df31a
SHA512 d09e5dded0d4babc6fc59d2c558881e37b29586aa7f42b8a9c690310d851d0cfda226861dc05f6532506b826af7afb29b4792be9814e61730cff51b9f7c6dfb6
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJhp:D6izaOIUYTjipvF2nSQp
TLSH
T19D63283ABBD55572D3B7437144B640E2AA39BC223EA1491F3882334C4973F26DD66B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3852	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_145b9acc8fe2560af6a268bff5cad7e4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3852	4648	2026-08-23_145b9acc8fe2560af6a268bff5cad7e4_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_145b9acc8fe2560af6a268bff5cad7e4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_145b9acc8fe2560af6a268bff5cad7e4_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 69KB
SHA256 c2f3853017cffbc180db1c92549d3c094e3ed6825e9fd570a3c4562ef71427c9
MD5 c0ec5c77557057e330eaf2da7a44d825
SHA1 610fe070f55af891612c31db1f25359456deb313
SHA512 5ec7f18efed5b1f692d41d75245ae03741007f22d6d38d13c2b939e7411d860ae5398c3d1ac893792178f1633b6a460191b2932c5e0d3c8edc1f245feb72d76c
SSDEEP 768:DYfoKSs710NIgIZwz3qEbDIhA5PsED3VK2+ZtyOjgO4r9vFAg2rqwdmCcaJhT:D6izaOIUYTjipvF2nSQT
TLSH
T18463273ABBD55572D3B7437144B640E2AA39BC223EA1491F3882334D4933F26DD66B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download