waski | 2d360ddd732a794cf74a9da20e8b38e810562a8e125bec94da19148f03465d6e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_8194f0ca6a6e63cad2cfdd46420c03a1_elex_wannacry.exe
Size 28KB
Sample260825-k48eaawtev
SHA256 2d360ddd732a794cf74a9da20e8b38e810562a8e125bec94da19148f03465d6e
MD5 8194f0ca6a6e63cad2cfdd46420c03a1
SHA1 d8f6a45804e0f7092b94251641beaab9c9ca676b
SHA512 38cc6c945a8c228fc8faa5802f89d993467551cae598117580a375d2a7640644e24cdd26049153564454e697a971e9105ad7c5d50a280a85a116b514bb4e9689
SSDEEP 768:vLoZWN6GGBZ2BbwEoP/NUOASsslhi5LcXmt:yGEWbwbF8swFcXg
TLSH
T1D6D22C3C6FD55AB2F3B7CAB6C5F65AC6BD35B073B902490D808603454C23B12ED91A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b4d-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
3116	operaupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_8194f0ca6a6e63cad2cfdd46420c03a1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	operaupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3116	2396	2026-08-24_8194f0ca6a6e63cad2cfdd46420c03a1_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_8194f0ca6a6e63cad2cfdd46420c03a1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_8194f0ca6a6e63cad2cfdd46420c03a1_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\operaupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\operaupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

operaupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\operaupdater.exe
Size 29KB
SHA256 01fbd48f3161cdf29c52052250082ae8aa04cdb8b0187b559df8d9af6fd85b45
MD5 b4402e43e588cda438539ea653a39d9d
SHA1 eea402bf627f830df5257a9a16a9bbc50223e29b
SHA512 77ef1d5590e4df0df0158bff1afcaae27e7fb4239714bb826fcceddf4850da850149df5c68c49427c9edeee254d29235a424608e62f11ef884fe96c1d24d8ad9
SSDEEP 768:vLoZWN6GGBZ2BbwEoP/NUOASsslhi5LcXmH:yGEWbwbF8swFcX2
TLSH
T108D22C3C6FD55AB2F3B7CAB6C5F656C6BD35B073B902490D808603454C23B12ED91A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download