waski | fc039d99b4246d8e40998e79582630e0ed526ab0a685a9b3b398e410114a21d5

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_3b2b36a1f38bb6396b2057ad995440bd_elex_wannacry.exe
Size 17KB
Sample260830-e2y5yazses
SHA256 fc039d99b4246d8e40998e79582630e0ed526ab0a685a9b3b398e410114a21d5
MD5 3b2b36a1f38bb6396b2057ad995440bd
SHA1 651eb390ac7b8f0f50fefb3277835d3721c42b2c
SHA512 a81b163feec444e257cc920f5ff71ada05b0a5ef4353783bac3baf9ff4dbbbc2895bcf8c2d21d1e1ba75a2a2cd736e2f6fc4ac6929b6b0384e6cf53be69670b7
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmtBUPN2Rp8JicBP+Dn:uTQWckBeEd6ml1pcg79UP4EJPJSSF9Ve
TLSH
T1768285395AD41D73E3FBC7B595FBC1D6B820B02B37035D2E54861B852D23B12ACA069D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00170000000115ef-4.dat	family_waski

Executes dropped EXE 1 IoCs

pid	Process
4580	codecsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_3b2b36a1f38bb6396b2057ad995440bd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codecsupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 4580	5796	2026-08-28_3b2b36a1f38bb6396b2057ad995440bd_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-28_3b2b36a1f38bb6396b2057ad995440bd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_3b2b36a1f38bb6396b2057ad995440bd_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codecsupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\codecsupdater.exe
Size 17KB
SHA256 b73d145e23e8194acaeb4ea1767d616ffc685423654ec7d5f2038d94bce0552b
MD5 ff613b3fdd586688f1e5c1c4ef64ac68
SHA1 63e60f76ef9253211d23ae95b7506a0add7ab277
SHA512 e43a0c91dbb892d83670f1619b2625bd520891ac3a52789c07e35b025926eba501f27b08be27a7682c7fe80e3990b3dcbaf15ac83a690c382fe3d367449f6eee
SSDEEP 192:uTk5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qmtBUPN2Rp8JicBP+DQ:uTQWckBeEd6ml1pcg79UP4EJPJSSF9Vl
TLSH
T1AA8285395AD41C73E3FBC7B595FBC1D6B820B42B37035D2E54861B852D23B12ACA069D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download