f7ca321f0dcda84765b5d3f89cffc932b019a6d3a89560417eab6cf277aa539d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_c4729fcbbd807a0002a1fd9d52766115_elex_wannacry.exe
Size 62KB
Sample261026-qce7babb56
SHA256 f7ca321f0dcda84765b5d3f89cffc932b019a6d3a89560417eab6cf277aa539d
MD5 c4729fcbbd807a0002a1fd9d52766115
SHA1 4ee1434d4825212ce3ec7ab4ab426993379225bf
SHA512 eb9edef87d82bd04e899c16522e1e3ac44d4d168a7b52ffefa3e1b0d6b0a528647779cbe6d6f8b7de0454f910f28462fd19a1d80f699e888f1aba1d8ee2df266
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAuY:QbjXRrs9sINeZEtejlIkoLN127BFVn25
TLSH
T1CC53AD38AFD515B2E37BDAB7E9F651C6B935B4233D026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4904	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	realupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	realupdater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_c4729fcbbd807a0002a1fd9d52766115_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4904	4536	2026-10-25_c4729fcbbd807a0002a1fd9d52766115_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-25_c4729fcbbd807a0002a1fd9d52766115_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_c4729fcbbd807a0002a1fd9d52766115_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 62KB
SHA256 edfb3b69509c35edf6d902ea0d11fc2e8e0f77ecf054dc265c6380f2fb23b1e3
MD5 c948b11b0bb23693014908203fb49ed0
SHA1 1de738541642125af244bdaa3c5a9e7af41ee3e1
SHA512 4183a4f692a8d34373044570cc948f3967e90a6bf1446e5e5d7c98dd962d759523506a9115f53f043f9a0cbaf6b139ebbbe98e80b81aa122f8b26ca266a582a1
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VAuG:QbjXRrs9sINeZEtejlIkoLN127BFVn2r
TLSH
T1CA53AD38AFD515B2E37BDAB7E9F651C6B975B4233C026C0D40864B840C73F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads