0b6d9a10fd60a222c53f1ceaaf68fa697d2bb30752fdb6367a21b6de88205f2b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_1d1960e8ee5f789b5802c5877fc2a0a4_elex_wannacry.exe
Size 1.2MB
Sample260522-sfa3wahs8t
SHA256 0b6d9a10fd60a222c53f1ceaaf68fa697d2bb30752fdb6367a21b6de88205f2b
MD5 1d1960e8ee5f789b5802c5877fc2a0a4
SHA1 05324932d900a47d587a7b4934ca5d93a89151d0
SHA512 7a2fdf9f29a088a05b631b5a17bc983c50264d11f2f3468641dd919dfbcd1107f27b08d9f8c24fa98cfc373452c814cc83c08a90030a82922f1aebdd6f977ea0
SSDEEP 24576:L9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVbjVljQkaZkCV1lS:L9C0Xgfe2DRe+rZVbjHGnI
TLSH
T1A7553338B21384B1E1A506B20F5E19A06B7A363C0CB56107FF8AC57B5D7EBC7E13A591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x0000000000431000-memory.dmp	UPX
behavioral2/memory/3396-1-0x0000000000400000-0x0000000000431000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/3396-1-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4056	3396	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_1d1960e8ee5f789b5802c5877fc2a0a4_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_1d1960e8ee5f789b5802c5877fc2a0a4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_1d1960e8ee5f789b5802c5877fc2a0a4_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 416
  2⤵
  - Program crash
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3396 -ip 3396
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3396-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3396-1-0x0000000000400000-0x0000000000431000-memory.dmp