cedc42af87d2d29b7c4526e4e5915f028b7ae02c210bbb2f6519fc155a783d76

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_36f08504188b3dd7295048698353e622_elex_wannacry.exe
Size 49KB
Sample261003-ry8les1and
SHA256 cedc42af87d2d29b7c4526e4e5915f028b7ae02c210bbb2f6519fc155a783d76
MD5 36f08504188b3dd7295048698353e622
SHA1 0b8c4c17feba1813cdc883978bcfcbb52b945107
SHA512 1dea74ec784a2e823e4488d4e4e9f1dc69a3ff5a0af9d8c57ec6caeb89552e7d2f5036db8a5c782fa0d16af479af429885c3d24b3059b01a987d6962ddc7f5cc
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwWMW:nAYTjipvF25W
TLSH
T1643319297BE598B2E3BB873504B641E1593ABC227DA1861F3C81338D8872E61DD54F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2996	foxupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	foxupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	foxupdater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_36f08504188b3dd7295048698353e622_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foxupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2996	3352	2026-10-02_36f08504188b3dd7295048698353e622_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-02_36f08504188b3dd7295048698353e622_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_36f08504188b3dd7295048698353e622_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

foxupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
Size 49KB
SHA256 2381efbf24b54c6d54a60cadf91a166fb5fb5db3aa2cb7ed612c4bbfc62d1a9a
MD5 d65bd9c4c7914e971c8e64181c5695e2
SHA1 5325b8ef774d2c31e041a95afb35a7cad56b198d
SHA512 d4cc40d1f307cd0af11b9ad8b43b724f35cc49fb79c635546623a396d86b4376446b8671f08ca94ecc91d6aed2c50f5646dc5968496ac7a35188a454e1b8fc01
SSDEEP 768:nYfoKSs711PsED3VK2+ZtyOjgO4r9vFAg2rqwWMt:nAYTjipvF25t
TLSH
T1DB3329297BE598B2E3BB873504B641E1593ABC227DA1861F3C81338D8872E61DD54F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads