504a364a56ae99ca576dc9e9cb60111c33d3dc46ab82c315912d0dbc45e93b0f

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_38a0fc39a34bf821e02b0c1dc3bfd6f2_elex_upatre_wannacry.exe
Size 22KB
Sample260825-stkt8sbm71
SHA256 504a364a56ae99ca576dc9e9cb60111c33d3dc46ab82c315912d0dbc45e93b0f
MD5 38a0fc39a34bf821e02b0c1dc3bfd6f2
SHA1 3dd9baa9bd782d22d9fd2ca79e1ddd865129ecd1
SHA512 7ae26794aa7db6e2bfde4527377e0ee82a6a41b34bd3b5d2b5797b206c9096fbdb9ccf87e0c369bafece482f30f98bec3645be38bd551096de03a7006caf2e97
SSDEEP 384:EI+Wv6y2MaBTf90u113S/LjggggggLvggggggggUa3EEA:EW9QBiur3SvggggggLvggggggggUa34
TLSH
T1F4A2A57027C119A1E7A34D7295B3724DE15DBE2363035ECF0A70FA414BF27D2A971A98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
440	btkba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_38a0fc39a34bf821e02b0c1dc3bfd6f2_elex_upatre_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btkba.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 440	4136	2026-08-24_38a0fc39a34bf821e02b0c1dc3bfd6f2_elex_upatre_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_38a0fc39a34bf821e02b0c1dc3bfd6f2_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_38a0fc39a34bf821e02b0c1dc3bfd6f2_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\btkba.exe
  "C:\Users\Admin\AppData\Local\Temp\btkba.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

btkba.exe

Path C:\Users\Admin\AppData\Local\Temp\btkba.exe
Size 22KB
SHA256 bdb79604a73adf911daaaa650dd30ddf6e61650ad9abdab6870d29e569e03b4a
MD5 77ff2e84622c0f9dee16cb81bc0a81a8
SHA1 b54fe7de3f3b716214bb7d204d67f0425ff53cf6
SHA512 f9b850d6e3386772948dbaebcf8fb86f6f6b94b02dfc6f1a078c2b5406251132e759e518a28314c7f6437eccea0a11d9fe1a0a0efd7fe0eed3164e3b17bc40cd
SSDEEP 384:EI+Wv6y2MaBTf90u113S/LjggggggLvggggggggUa3EEp:EW9QBiur3SvggggggLvggggggggUa3R
TLSH
T19DA2947027C119A1E7A34D7295B3624DE15DBE2363035ECF0A70FA414BF27D2A972A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download