765e3c74fa0efd677eb7eca52e2585e6530b71bb0f72f04135dd64d499789819

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_ad5b4e2c07d82705c80fb30b2250a7c1_elex_wannacry.exe
Size 23KB
Sample260825-e1t5lael4t
SHA256 765e3c74fa0efd677eb7eca52e2585e6530b71bb0f72f04135dd64d499789819
MD5 ad5b4e2c07d82705c80fb30b2250a7c1
SHA1 64891c93fe3168a4ae6e0bac9ceae89a12af8837
SHA512 9e54838a2c2032d0097cabcab15f5d81f9e4a5d23611f2276e747df314def6b4922a9a12a72e4cdac8e2b4ff1c5596e752c355564c19a1fe4d731bbd8f63faef
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mHJc7V4p+f:d/3xd1HXzoy44hXPyA+f
TLSH
T139B242B59BC10DF5D633DEB984B6A5C3A563F16E79165A0D44C22F012F13343A8A2D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1328	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_ad5b4e2c07d82705c80fb30b2250a7c1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1328	2396	2026-08-24_ad5b4e2c07d82705c80fb30b2250a7c1_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad5b4e2c07d82705c80fb30b2250a7c1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad5b4e2c07d82705c80fb30b2250a7c1_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 23KB
SHA256 d31ca5364df9df2f37a7e1f4e60064b00c221dd715a1e9614062bb031cef9c94
MD5 4d197650346bd5d15362c11a93f8d392
SHA1 32a350aa9e47fbbdf4a3f8a0f76fd3dda7d00041
SHA512 135939e3e9c2414c737a4c4f0bb5533e6c71404d126efdae94bdcb11710645e370f86742728ef2a909e5ba72b8c07f4eeb337045101be24b88c016decfc8d1a7
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mHJc7V4p+3:d/3xd1HXzoy44hXPyA+3
TLSH
T104B242B59BC10DB5D633DEB984B6B5C3A563F16E79165A0D04C22F012F13343A8A2D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download