7a425e6cbe24f80626469c0a13bff243ada69c88d519868ace1d708552771fd8

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_c82c5c34dfb48cc7bb11bb8254ba3132_elex_wannacry.exe
Size 34KB
Sample260825-btlyvs1xd1
SHA256 7a425e6cbe24f80626469c0a13bff243ada69c88d519868ace1d708552771fd8
MD5 c82c5c34dfb48cc7bb11bb8254ba3132
SHA1 a0ae90fa1e44f5ede18090f60a009f8cd87d51d7
SHA512 9f8b0383de54fab8cec0c0632dd7ee0d1db9d129bcd95e8836a7b683f014e75f0f0a4470951ece06bed951a60e14388d0b3cee9a93aa77a23384d474d803265c
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbimXf2Zc5VSEJ0:Kz2u4LJjBaECkLSi7xsYhaKDV4Bc3J0
TLSH
T194F20F38AFD959B2E377C5B6C8F269C66836BE2275015C0D509637400C73B13BDA2E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5656	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_c82c5c34dfb48cc7bb11bb8254ba3132_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 5656	952	2026-08-24_c82c5c34dfb48cc7bb11bb8254ba3132_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-24_c82c5c34dfb48cc7bb11bb8254ba3132_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_c82c5c34dfb48cc7bb11bb8254ba3132_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 34KB
SHA256 b24d40b47d4a1ecb62e8b741e93c12e1ff617e56786af6b3747328bc207f0641
MD5 935b22e5f1afcad76779c39b8da2bb45
SHA1 1349aced7e73b45d87386e353e43801807c1e063
SHA512 09076c38e13e94544dae61d2a0e237e62bfdd54ed418e3d6716fef8eca972070ce163a9017362bcaac09780fdfe989681f5d44a9d5abd3d609db24531e5f2912
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpbimXf2Zc5VSEJz:Kz2u4LJjBaECkLSi7xsYhaKDV4Bc3Jz
TLSH
T1DCF2F038AFD959B2E377C5B6C8F269C66836BE2275015C0D509637400C73B13BDA2E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download