02708d90022cea5eaf8eae5c1cde2d84730038b7f80e56b02c2153033a1644e0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_0fc867b252926981906fd51f4c2cbaca_elex_wannacry.exe
Size 20KB
Sample260825-xqmxmsaf22
SHA256 02708d90022cea5eaf8eae5c1cde2d84730038b7f80e56b02c2153033a1644e0
MD5 0fc867b252926981906fd51f4c2cbaca
SHA1 3ce094e2ba3e25acebb71631dd6c7f2e757ab26e
SHA512 ec4101552c4a7e2d3dbd16441c4218afd6f3a769b552b3b3937fab7d8840363c6e45381df840860d5d61164ad7aa691060232d3dbd90de41b738022635814d2d
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzZ8:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDM
TLSH
T133929268C3D99DF5D546407A8C32A9611072FF1A82242D2AB86A35011DF3643B2EBDBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1572	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_0fc867b252926981906fd51f4c2cbaca_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1572	4972	2026-08-24_0fc867b252926981906fd51f4c2cbaca_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_0fc867b252926981906fd51f4c2cbaca_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_0fc867b252926981906fd51f4c2cbaca_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 20KB
SHA256 ccda37ebedb1eae8f0564b54df0bd0552db69956cc2c61bd651f9074412fd26b
MD5 90a6dbf59a05ca939ff1cfb53041f085
SHA1 6555b562b3d3308fcc91e61497ee5a04e6b6620f
SHA512 c01d80d1228d8bb8b93be125e2c2c5fb929a41767d261011817601b881393a7bb7e871cfca00d1a0f67f692646a1cc6dbece89fac415f5674392a0f140844644
SSDEEP 384:ujOyzd2ajvJIuPJcTh1G4LJjBaECkeiJSUj7xsgNhaKDvdzZGhp:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDc
TLSH
T11F929368C3D99DF5E546407A8C72B9611072FF1682242D2AB89A35011DF3643B2F7DBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download