8a74dd8f1d71af0d7e0fc5339eb8455215d55d0d005159f5d9f3fd5d84a2a5fb

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_d64d2c6a5741a4737460297ca49948de_elex_wannacry.exe
Size 60KB
Sample260826-h4bdfaaj21
SHA256 8a74dd8f1d71af0d7e0fc5339eb8455215d55d0d005159f5d9f3fd5d84a2a5fb
MD5 d64d2c6a5741a4737460297ca49948de
SHA1 6456bc371e10f5d68c6643ad30f5cff6c3c35d68
SHA512 03c647739ee6ce75210560abac6cf8107a7d1b4491c0204c13308b2ce8a725534a6aed41a19a53d59afbbb7e43ca6346365475311dd294cbcb637ab62c57b559
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAc:QbjXRrs9sINeZEtejlIkoLN127BFVn2w
TLSH
T13553BD38AFD515B2E37BDAB7E9F651C6B935B4233D026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3016	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_d64d2c6a5741a4737460297ca49948de_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3016	1728	2026-08-25_d64d2c6a5741a4737460297ca49948de_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-25_d64d2c6a5741a4737460297ca49948de_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_d64d2c6a5741a4737460297ca49948de_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 60KB
SHA256 cfd3330f389252f8c7bd163c04b4a0b0d572dad82c236e6e002ac0d9d9a3c61f
MD5 01a7f75d41291c73671a035e4498a025
SHA1 531bef0781e6b5597bfb1ea6e0663f462fe42eb3
SHA512 665607f0abc0319861cca76805bbc21678409e35a5a4797afca5146f70f8ac32111243348466149da1bfdb784e6a98551b2a334dcefe7aa5b2c5b37a4e6bc44d
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VA64:QbjXRrs9sINeZEtejlIkoLN127BFVn2F
TLSH
T15353BD38AFD515B2E37BDAB7E9F651C6B975B4233C026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download