a253cb8a4f60ddcee57480146da77c3284aba540b34b5794d740f399b6b8afef

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8cb09b2bc1b8ebfa82f6910746a1703c_elex_wannacry.exe
Size 56KB
Sample261102-sp2besds2q
SHA256 a253cb8a4f60ddcee57480146da77c3284aba540b34b5794d740f399b6b8afef
MD5 8cb09b2bc1b8ebfa82f6910746a1703c
SHA1 e131c47a182c9a7cded738d7f6403a67f5bf1872
SHA512 5490d6c9fb33797b9e891ec933e2332550efc5f42264d05b07268af075c1f4851301e889f12ebc95ac380eeb79ed53c045da17d501eb209c1525e6e9dbbc27d5
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6VY:QbjXRrs9sINeZEtejlIkoLN127BFVn27
TLSH
T11D43BD38AFD515B2E37BDAB7E9F651C6B935B4233D025C0D40864B840CB3F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4204	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	realupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	realupdater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_8cb09b2bc1b8ebfa82f6910746a1703c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 4204	5976	2026-11-01_8cb09b2bc1b8ebfa82f6910746a1703c_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8cb09b2bc1b8ebfa82f6910746a1703c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8cb09b2bc1b8ebfa82f6910746a1703c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdf[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L1V6K5E2\pdf[1].htm
Size 795B
SHA256 e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
MD5 5d8d79c3cb9af023240b1be6f5057aaa
SHA1 df22980677b134e83d878893f7c7984e0d78a240
SHA512 66f432b622cee0bcc06cbc0f833de1471ea36c295b4cd93eb848d97e69c2252acd2fc8972db51ea35475a424f4d6cb5001325525fb04f71b8704eb24de1c4008
TLSH
T11501F139C242A80AF0232660F951E67061584252639B1F257AFEF776F5CE1A35D723CC
MD5 SHA1 SHA512 TLSH

Submit Download

realupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\realupdater.exe
Size 56KB
SHA256 aebed1717cefc5d2b87f81820196e8bf7f63977bd7956f56ec97f9bf5718c1de
MD5 f1d86e558ec0d35429c7f17fa005a8c6
SHA1 824e7701a4c07c6f1e781c5ba22bb28061751c69
SHA512 e2ef4b9efcd4cb2854a526c740c61b27b8538982790b503e892cccccefe41d21034b53b2bee5eddb183fc9783fa82fbeedee3c4ef4ba312f295ceb24c17c8b56
SSDEEP 1536:EdbjXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8grvLiQKLAh6Vp:QbjXRrs9sINeZEtejlIkoLN127BFVn2W
TLSH
T12443BD38AFD515B2E37BDAB7E9F651C6B975B4233C025C0D40864B840CB3F56ADA1A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads