1d5d4c4b22bb703ea82f6780432b0fd70f1ef467888cbb4776615e6685997823

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_d969f0f22155597f788b8705ff576a00_elex_wannacry.exe
Size 22KB
Sample260908-e2k83szycz
SHA256 1d5d4c4b22bb703ea82f6780432b0fd70f1ef467888cbb4776615e6685997823
MD5 d969f0f22155597f788b8705ff576a00
SHA1 1f370c43d359ba18ad606a9cfbfbd8fb78b1275e
SHA512 25a9a2d9bb6a2d0f406e56186f6cd3de5a970a59d0c0b7275be291e6de01cc971da6d30ac6e85c6b3d7010178c902cdd827fb8dc77e2d272f58005b64b81494a
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+W1PPt+apL:d/3xd1HXzoy44hXzBpL
TLSH
T1DEA221F19BC209B5D633DEB984B279C3A553F16EB9165A0D44C22F066F13343A4A2D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2720	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_d969f0f22155597f788b8705ff576a00_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2720	4788	2026-09-07_d969f0f22155597f788b8705ff576a00_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-07_d969f0f22155597f788b8705ff576a00_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d969f0f22155597f788b8705ff576a00_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
Size 22KB
SHA256 b0bc5b79c34f8c784a9ef2dab2458d41d48fa474cc0ca771f0acd815e24ad157
MD5 b38fe497c4edd79e0239700be033e1ac
SHA1 69fec4045da7e2077095497cc0316747f1fe6cde
SHA512 1384a223aea797e0df75a03f1965a31c98a421c6662aa96a2b197f56e681db78fdeb75a707434a304a415a496f37b17fb413ee7e6d995741e406f0487b3566c4
SSDEEP 384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+W1PPt+ap5:d/3xd1HXzoy44hXzBp5
TLSH
T18CA222B59BC20DB5D633DEB984B279C3A553F16EB9165A0D04C22F062F13343A4A2D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download