e915127ade3e65e1c8ae73d73f0252c71e797c89c748ec53b6ee2aca5a9bf1e3

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_e0fb23c92f5b2bdaa2125f29c42bf16f_elex_upatre_wannacry.exe
Size 40KB
Sample260825-1dex2sen4s
SHA256 e915127ade3e65e1c8ae73d73f0252c71e797c89c748ec53b6ee2aca5a9bf1e3
MD5 e0fb23c92f5b2bdaa2125f29c42bf16f
SHA1 721a62d4dc377b7f7b7d99b9635c6f07e90cea5a
SHA512 9715c8d108ff6447b54a22196bc331dd2f1fc9bfab72d1af7466b1fb800a6dc5cbbab11cb3a6e4dc1d5e2563fc3052f5fd89edec39e95da1942740c84ea56c0a
SSDEEP 768:mUz4HXnmTggggggLvggggggggSvNltsdUk7Nz1XzTx6QXTnhNQ/ggZ+:BMH3lNMKkPzT8QjbQIx
TLSH
T1351300386AD01572D37B9EB685F651CEB96DBD233A035C4E40B2F3400AB2BD7ADA150D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5428	zzyap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_e0fb23c92f5b2bdaa2125f29c42bf16f_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zzyap.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 5428	5812	2026-08-23_e0fb23c92f5b2bdaa2125f29c42bf16f_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_e0fb23c92f5b2bdaa2125f29c42bf16f_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_e0fb23c92f5b2bdaa2125f29c42bf16f_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Local\Temp\zzyap.exe
  "C:\Users\Admin\AppData\Local\Temp\zzyap.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zzyap.exe

Path C:\Users\Admin\AppData\Local\Temp\zzyap.exe
Size 41KB
SHA256 f1d76b737779e69f5c218f52278fb5a021263bb3ba684c16e6ddc5f50249e6d7
MD5 0fbeef809f345f3e703e9f4d978b1ce7
SHA1 78fab345076cb31273f4e29621cb1b874f55ac6a
SHA512 9037c64683611a6ea59dd94c0ba4efac06165c09c5821c42b2f9d5d3e42d80ad5143c5c4f64d31a9169089aa50c1e5a0f7578df11bf7b713ad8ff82ddf449b97
SSDEEP 768:mUz4HXnmTggggggLvggggggggSvNltsdUk7Nz1XzTx6QXTnhNQ/ggZd:BMH3lNMKkPzT8QjbQIS
TLSH
T11D1310386AD01572D37B9EB685F651CEB96DBD233A035C4E40B2F3400AB2BD7ADA150D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download