965a5a0395017661404c8bdc1c6e675593daf7e81a3378c113272fb9b53f9ff8

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ed3640124148ea1773a610a340c1970b_elex_wannacry.exe
Size 31KB
Sample261102-epntfag14k
SHA256 965a5a0395017661404c8bdc1c6e675593daf7e81a3378c113272fb9b53f9ff8
MD5 ed3640124148ea1773a610a340c1970b
SHA1 84340fcc5fbde492c6ef5d94154ac5638b79a975
SHA512 822b79e40a52ef61397c37a7b904dd0d211c6ada3a8afd15a0aae7fee6ec2f9e04c01edb07b7ee78d9f45248a28721e1d96d95207002f64f8e26bb2254900c8c
SSDEEP 768:Q3NXvkkRfDjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+xNPSQU+yVlkn:EdbjXRrs9sINeZEtejlIkoLN127BFVny
TLSH
T11FE25434BFD458F2E3779A73F9F691C2B426795238126D0C40966F8049F3B52BDA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3252	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	realupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	realupdater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_ed3640124148ea1773a610a340c1970b_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3252	4904	2026-11-01_ed3640124148ea1773a610a340c1970b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-01_ed3640124148ea1773a610a340c1970b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ed3640124148ea1773a610a340c1970b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdf[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8999WJP3\pdf[1].htm
Size 795B
SHA256 e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
MD5 5d8d79c3cb9af023240b1be6f5057aaa
SHA1 df22980677b134e83d878893f7c7984e0d78a240
SHA512 66f432b622cee0bcc06cbc0f833de1471ea36c295b4cd93eb848d97e69c2252acd2fc8972db51ea35475a424f4d6cb5001325525fb04f71b8704eb24de1c4008
TLSH
T11501F139C242A80AF0232660F951E67061584252639B1F257AFEF776F5CE1A35D723CC
MD5 SHA1 SHA512 TLSH

Submit Download

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 31KB
SHA256 11eef4ffb99d1d7c8359c135cbb1cc4d7671e98dc594bea2818e4238faa86bf6
MD5 c1bf88622d2665f282bc857378d95f4a
SHA1 e954ebd48d0b10c5e95b36d7f9d96bf4781a39c4
SHA512 8b2248875e8a68a43cbb4a449b3b23e5e1f1ef61ba9b4e3219d7a1157c83d3d5e923c66c041de7ddae9b2c30f43495f4007aa25e9fd261ef740bf77b62c040c6
SSDEEP 768:Q3NXvkkRfDjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8Oo+xNPSQU+yVlkq:EdbjXRrs9sINeZEtejlIkoLN127BFVn/
TLSH
T16BE25434BFD458F2E3779A73F9F691C2B826795238126D0C40956F8049F3B52BDA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads