79dd3c47d971d4eb2b2ede4c7d3ec9bab0b76510f4279adce09933a90b284b71

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_bf19f3bedb3913fbca23481643d91c87_elex_wannacry.exe
Size 58KB
Sample260825-cs4b7a1zhx
SHA256 79dd3c47d971d4eb2b2ede4c7d3ec9bab0b76510f4279adce09933a90b284b71
MD5 bf19f3bedb3913fbca23481643d91c87
SHA1 7677fed574fb4c748f297e1c389d0bb0c7e71793
SHA512 818dcad5f134a835a858d44d44eba771aa21518bf2b2d05c6624035b233361714924a20f7f471aac0b4ae806eb3aeeaffc94fa25fe945117a93e5b1a720e82e0
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKB/:d2jXRrs9sINeZEtejlIkoLN127BFVn2e
TLSH
T1E443BB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3428	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_bf19f3bedb3913fbca23481643d91c87_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3428	4248	2026-08-24_bf19f3bedb3913fbca23481643d91c87_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_bf19f3bedb3913fbca23481643d91c87_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_bf19f3bedb3913fbca23481643d91c87_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 58KB
SHA256 b7ca925db4c917b256f758023324fc56c1003367e2c16abc83e3e8254ad9c588
MD5 6c66ee2389585bc72259c50cacd72c40
SHA1 06b6172d6aecc36f00c5540e0c26c28bf3261ca1
SHA512 9fa8ebe8d7e12cccf0c329ebcedd128ad957a3bfc8ebb4dde7a827c3cdd5ea71c8521504e98472b84ac4caa68f78fdb2100e1af88eeb2b1dc5d9db3627f8a9d2
SSDEEP 1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCz4iKB4:d2jXRrs9sINeZEtejlIkoLN127BFVn2V
TLSH
T13543BB38AFD515F2E377DAB7E9F695C6B935B4233C025C0D40865B840CB3B52ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download