cc5edb536f16d4cc1176fa560031f8949d6305910480c40ccfc5842c9340faab

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_a8773c83288c3d44726f9468e3a10894_elex_wannacry.exe
Size 54KB
Sample260831-hwaf6sen6v
SHA256 cc5edb536f16d4cc1176fa560031f8949d6305910480c40ccfc5842c9340faab
MD5 a8773c83288c3d44726f9468e3a10894
SHA1 4c18305241c5935563aaf948e5a401f2ad16d5c6
SHA512 b1203feb4385862720b2c84c983c1188b900aaa713087169a07d0d5b238bef6b0cc017b109dde3396f0a96fc8f86468b4e6749260a0e79f1840f1bedf00fa75d
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcHi:rmwfKOj1TRf/2SZLO8iJu7I
TLSH
T1D343AB3CAED51572E37BDAB6D6F216CAF975BC223D01680D408633450C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
124	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_a8773c83288c3d44726f9468e3a10894_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 124	5836	2026-08-30_a8773c83288c3d44726f9468e3a10894_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-30_a8773c83288c3d44726f9468e3a10894_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_a8773c83288c3d44726f9468e3a10894_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 55KB
SHA256 7db40e85b618e01f6a151db0834d9d9f378a8d6fd3a612853a37702cd083c34a
MD5 94b3566042a06351bd43da3a58ded4b7
SHA1 dd2b2cc9d50805711f95331f177ef326088e72be
SHA512 8548a009cad0eee83302f7ee1a84aaa30b8702b122228cbe26bdcd273ed4e299a9a6a72fe937770a4d264415eb42bc11c91c742c2d5ff598d86a2919413838b4
SSDEEP 768:RVSJwmwf4NOj1TS5of/2DG86/LO8PqJuFTgwslRcHs:rmwfKOj1TRf/2SZLO8iJu7u
TLSH
T16743AB3CAED51572E37BDAB6D6F215CAF975BC223D01680D408633450C33F66ADA1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download