fe82c90e23d2eaf185a0aa82f889f2e0b04a14625399a86d760a22455b6eb3b3

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_db936fdc8f6c2e2a88efb2a72564af87_elex_wannacry.exe
Size 27KB
Sample261107-1dlets1z2m
SHA256 fe82c90e23d2eaf185a0aa82f889f2e0b04a14625399a86d760a22455b6eb3b3
MD5 db936fdc8f6c2e2a88efb2a72564af87
SHA1 80b1eb9a98ed1b17bd392cc6f06c27db123a248b
SHA512 9656353f77b9f239e38f95af70ebf2cf5d213720ddbbff19aef60fba90a6aa89bc6212eb2d7cc974c444ea1ffc93e2089a3f4be9948ea43fbbc6c8f5d88dbdca
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84kqu:Kz2u4LJjBaECkLSi7xsYhaKDVif
TLSH
T1B5C22E38DAD559F2D37795B6C8F2A5C26872FE22B1111D0E948636010C73B43BAE2D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5112	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opera_updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opera_updater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-06_db936fdc8f6c2e2a88efb2a72564af87_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 5112	5232	2026-11-06_db936fdc8f6c2e2a88efb2a72564af87_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-06_db936fdc8f6c2e2a88efb2a72564af87_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_db936fdc8f6c2e2a88efb2a72564af87_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 27KB
SHA256 1f21c57adc809b4ba3117f0de07c148ba1503d27d3b9434804645ebf9ca8a7c1
MD5 8ae2b4f87b4460b3610f9798a9998d5f
SHA1 c3610c56cf2a2d86bc05c451ac9dc7345f09ea00
SHA512 8aacd7076bbcb1c979c0763a8e933ad0c6ee54717b244257bec9e41c0ac32d80b07b99a20d82d4c5460dc2bada0ca64424e5be55a55e3a044652663ec045c73d
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdk3o84kq1G:Kz2u4LJjBaECkLSi7xsYhaKDVigG
TLSH
T1FAD21E38DBD559F2D37795B6C8F2A5C26872FE22B1111D0E948636010C73B43BAE2D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads