502fa1c80f2c261f572c66527f30e3e86dc745aefe76bdcadced3087aa408ba2

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_f3620e9e6f9ce88a6e1a9e6a7e88f829_elex_wannacry.exe
Size 20KB
Sample260826-csskpa1fre
SHA256 502fa1c80f2c261f572c66527f30e3e86dc745aefe76bdcadced3087aa408ba2
MD5 f3620e9e6f9ce88a6e1a9e6a7e88f829
SHA1 1fa733abb6387d88f0c2bca2dd909fc74280ec8a
SHA512 e9bb33c87c6fcd19a1ec28280a54c2c0222be822218c9072630d57e5f5d09a0582d37f8e7ef07e01705838e4e987ae888e6951a048c8e19a6453ce517b6bfb2f
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0Rd3PnA7hjGeKM4Zn:nYfoKSs71dv4/0073PnA545
TLSH
T13992B43D6FE91E72D3B7CAB648F392C6AD25B02379035D0DD48217898C17B02ED9499D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6640	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_f3620e9e6f9ce88a6e1a9e6a7e88f829_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 6640	3768	2026-08-25_f3620e9e6f9ce88a6e1a9e6a7e88f829_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f3620e9e6f9ce88a6e1a9e6a7e88f829_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f3620e9e6f9ce88a6e1a9e6a7e88f829_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 20KB
SHA256 82d4c2071ac308dd106fdc46eb0410be2f9c51f6597795b557097dc12e298f2e
MD5 0ca613df6b67278372f47313ef57c029
SHA1 8220c6537196f7c3ad993fe277dd85dc318c8fa4
SHA512 c3eddd00fc7ffc6bf14ebd5db6420578729c6a86a920173dc3130759f4951ba0d06e4d536e36e0301f16ee5462e8db29d87420f7d4f0bde09c6622e26bfc1e33
SSDEEP 384:nYRpfgBcDZG3snl1YgdvJy/FG0Rd3PnA7hjGeKM4ZZ:nYfoKSs71dv4/0073PnA54X
TLSH
T18E92B33D6FE91E72D3B7CAB688F392C6AD25B42379025D0DD48207898C17B02ED94D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download