1dce824f6342e0cc8148cdaf28019effb8eb2ea6c707cf22fc8504bcaaefd37f

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_7e7fd96c1c4fb4634217c03e851d0455_elex_wannacry.exe
Size 34KB
Sample260905-25lqcabk21
SHA256 1dce824f6342e0cc8148cdaf28019effb8eb2ea6c707cf22fc8504bcaaefd37f
MD5 7e7fd96c1c4fb4634217c03e851d0455
SHA1 37cff2e102894a0a450e9334dd38cda4b95982b3
SHA512 ee7e8c5a0c80c2f7e6333790847eb5a8a261cc7614e4eba9867a582e3fff7ae28a44ed787c8e1e4ca241d073cec51cf8813e0cf7040c62c8fc3bbbe41a24db98
SSDEEP 768:cpaPBfujHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+IuoSVMFx6zuzH/yk1:d2jXRrs9sINeZEtejlIkoLN127BFVn2U
TLSH
T12AF2FE38AEC415F6E37792B3F9F694C6B926B96335125C0D40962F850CF3B42BDA190E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5112	trueupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_7e7fd96c1c4fb4634217c03e851d0455_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trueupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 5112	1612	2026-09-03_7e7fd96c1c4fb4634217c03e851d0455_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-03_7e7fd96c1c4fb4634217c03e851d0455_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_7e7fd96c1c4fb4634217c03e851d0455_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trueupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
Size 34KB
SHA256 5c2584f9490b0a690b141c76f0f0219abb2d09ccb71313f834c73244d47b9c97
MD5 26833e3d07f1baac62634ed23d84c8f3
SHA1 9e7d6e3ad30ef806d4c424e6e79bf570d8e93d9f
SHA512 780629b38e95418b094c8d0065a7e26b1a7b86658e9705c9ccbde4a7731d596970ee4323272ad016aa17d641e64d314b646b0626c8ae590de3dca2d28c7c7ed8
SSDEEP 768:cpaPBfujHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+IuoSVMFx6zuzH/ykk:d2jXRrs9sINeZEtejlIkoLN127BFVn2F
TLSH
T1B4F20E38AEC415F6E37792B3F9F694C6B926B96335125C0D40962F850CF3B42BDA190E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download