9169eecdba067fca16de6b7d328c64fd725a848f86cfc7d7c63934d61222d9be

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_978a30d79670d3c410928da144a782bb_elex_wannacry.exe
Size 27KB
Sample261029-2211vsty7l
SHA256 9169eecdba067fca16de6b7d328c64fd725a848f86cfc7d7c63934d61222d9be
MD5 978a30d79670d3c410928da144a782bb
SHA1 5280e1f4013a72d3b64b85e54a02a5353dd0dc7f
SHA512 c1838734aa37e83df4bb9af9d5178878b247aad11e4dd84b87478bdb1b8a023d2627ff7bc0b2a422d395086c63492a3b87ab03fd9366409da1e004f205ba47ae
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84kq1:Kz2u4LJjBaECkLSi7xsYhaKDViI
TLSH
T18DC22E38DAD55DF2D37795B6C8B2A5C26872FE22B1111D0E948636010C73B43BAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5936	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opera_updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opera_updater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_978a30d79670d3c410928da144a782bb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5936	3116	2026-10-28_978a30d79670d3c410928da144a782bb_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-28_978a30d79670d3c410928da144a782bb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_978a30d79670d3c410928da144a782bb_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 27KB
SHA256 66b9c044218fc2fdc548424477c7f8c35b62a5f4afc0b398718ce507221b315c
MD5 1e541786aa2d557e23ddd96a0a1d3879
SHA1 ae150d6e4e49c2a3da33340bfe7477d9f86f81e7
SHA512 94a82314c45fde2d5d50cf70410da549e011050c32acdb5d681588560a02007a0d0381832a0f7399934c65278def27008cbfe56c889730c32f179dc33d8a23c6
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84kqb:Kz2u4LJjBaECkLSi7xsYhaKDViC
TLSH
T1A6C22E38DAD559F2D37795B6C8F2A5C26872FE22B1111D0E948636010C73B43BAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads