296a8e248ab052e9705f68be2027d8a79f5df5d1ca84e51c2ee026690c1339fb

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_4f20ea8a828f48fe580f8a0fa95f75de_elex_wannacry.exe
Size 862KB
Sample260511-tzbdesh15j
SHA256 296a8e248ab052e9705f68be2027d8a79f5df5d1ca84e51c2ee026690c1339fb
MD5 4f20ea8a828f48fe580f8a0fa95f75de
SHA1 0df6da016aaf81407137bdc7f679b5e6c4f1ef22
SHA512 8b4d958f8e8f9fc14a4aa7850f6ca8006d4c4cbe3662812b5ae5d5e151036d014fbc0476d8d4dc1f322dec9cd9a35cf4f95de0acfbd6b116d098300409e9829c
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVb3P/:e9C0Xgfe2DRe+rZVb3P/
TLSH
T1BE152338F203C475E1690EB20FA92D90EB3771321DB47417F785C6AB6E7AAD2E035295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	1592	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_4f20ea8a828f48fe580f8a0fa95f75de_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_4f20ea8a828f48fe580f8a0fa95f75de_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4f20ea8a828f48fe580f8a0fa95f75de_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 416
  2⤵
  - Program crash
  PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1592 -ip 1592
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1592-2-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1592-1-0x00000000009B0000-0x0000000000A8F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads