dffd639eb313a13518b6a7b011f4bd184974fabeea8bd0e5302df72f1f3be4b3

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/05/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-01_b326f5e87298717848f4dec9b328af78_elex_upatre_wannacry.exe
Size 28KB
Sample260501-v24cnaat21
SHA256 dffd639eb313a13518b6a7b011f4bd184974fabeea8bd0e5302df72f1f3be4b3
MD5 b326f5e87298717848f4dec9b328af78
SHA1 3a77592bb89629637a3dd3ef20021cb2705eaa56
SHA512 7623614e785d7fe1f915e365c7395d525df5158c79f86cfe635fbf5a2caa62a3d4cf43764e8923258b302048481a7a7c832b711bf623ed97b7392972e7282426
SSDEEP 192:odwNKuC3kXWDxPJL8wmMkXfEfbFriWh07cnnSuYsKsIJoYWKL5unPDgCWYAP1di5:+qXJhMCEfNeuYs7KdyPIP1w0OX
TLSH
T1F9D2295325D808E5E49E0B782972611E4FA1B361432E44F79896B2DF4E8F7C2267C3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5424	1052	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-01_b326f5e87298717848f4dec9b328af78_elex_upatre_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-01_b326f5e87298717848f4dec9b328af78_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-01_b326f5e87298717848f4dec9b328af78_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 236
  2⤵
  - Program crash
  PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1052 -ip 1052
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads