389e51ed5641c9e89f35c35d5c488b05bc7a2f122721af80690d2bb9215b67fd

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_5b02b5ed6d5ca97d34aba867526f6aef_elex_wannacry.exe
Size 28KB
Sample261110-xftmfaaa39
SHA256 389e51ed5641c9e89f35c35d5c488b05bc7a2f122721af80690d2bb9215b67fd
MD5 5b02b5ed6d5ca97d34aba867526f6aef
SHA1 a0cd7688326af7f4198b25581be49d64d63d3db8
SHA512 61ada29fdfdd939391ac73b64b1b9e52f78075256e51a14447803a01d4e33fa5d70ec21280f46d91e5b7e6f0165ed69fb750f0362669c87fa8709dcba7a25670
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpv8cZ6hl64Jt:Kz2u4LJjBaECkLSi7xsYhaKDVm16a
TLSH
T115D25138DBE95DF5F37785B688B2A9C12036FE22B911580D505637400C73B52E9A2EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3368	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opera_updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opera_updater.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_5b02b5ed6d5ca97d34aba867526f6aef_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera_updater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3368	1656	2026-11-09_5b02b5ed6d5ca97d34aba867526f6aef_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-09_5b02b5ed6d5ca97d34aba867526f6aef_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_5b02b5ed6d5ca97d34aba867526f6aef_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opera_updater.exe

Path C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
Size 29KB
SHA256 3d60bbb7f572db3b5d13325c019eec62b63c8a401d24979e508024e5ac5e5373
MD5 08a6423956f31ba368425f3930518e97
SHA1 bc6031021ccbd0118ed0297f117a16380e15bf77
SHA512 717121c433f978512424dad27bd521560b460815308779365908b69fbdd3d12494e5b52821dda9706d14ec1a2f54416adc755d5c068bad104562661cdc5f40f3
SSDEEP 768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpv8cZ6hl64Jf:Kz2u4LJjBaECkLSi7xsYhaKDVm16s
TLSH
T11CD25138DBE959F5E37785B688F2A9C12036FE22B911580D505637400C73B52E9A2EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads