bc90e68275226c2c6cf773f4af4f6941ae0a954851484b5d5c1ea96819a16156

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_c329969eee74f259f2e132954a6d305e_elex_wannacry.exe
Size 48KB
Sample260831-sdphgsbr3s
SHA256 bc90e68275226c2c6cf773f4af4f6941ae0a954851484b5d5c1ea96819a16156
MD5 c329969eee74f259f2e132954a6d305e
SHA1 48e1d320fb37fb559403103cd071350e62d487e2
SHA512 db6fafab31444440f56fa6d7a9326878272e7a5f4361cb981140923e1e101f64b52520c0b9fb6d4d2c19a40b76d81df24895baa93db17e385e2211b968585089
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwWMY:nAYTjipvF25Y
TLSH
T1222318297BE198B2E3BB873504B641E55A3ABC227DB1451F3C81338D9872E61DD58F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6080	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_c329969eee74f259f2e132954a6d305e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 6080	2700	2026-08-31_c329969eee74f259f2e132954a6d305e_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-31_c329969eee74f259f2e132954a6d305e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_c329969eee74f259f2e132954a6d305e_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 48KB
SHA256 13497f0eb24e8c550adbb17eb44deabf921e3161e099f3d0c714667609735712
MD5 02434a39899f9895e0673bfc7f942f0c
SHA1 1bd589ade1898ccf76905081dfb7b989352b4d63
SHA512 188987916e39ddc8bdec08098f09e51ebf58d8a062c4143094f74870acf73cd91ce87223ae598879a5bd261c1ab140b48d0082d46c03212ead4029c7be6b0e56
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwWMo:nAYTjipvF25o
TLSH
T1612318297BE198B2E3BB873504B641E55A3ABC227DA1451F3C81338D9872E61DD58F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download