30249c336ebd7cce74661940bb56e6a35d4461211942af7d42fa9657b7f5b75c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_5e5368712da6718a41b3171d3d3724ec_elex_wannacry.exe
Size 1.0MB
Sample260523-ls8rcafw5p
SHA256 30249c336ebd7cce74661940bb56e6a35d4461211942af7d42fa9657b7f5b75c
MD5 5e5368712da6718a41b3171d3d3724ec
SHA1 523d03194ab0f9a03eefd8f748c8c289fcd997a1
SHA512 7f0cb53a4240f84b7e19d4e2c9933c946fc1044adfb3f801df4569c3dc319aae8820d0de38ab65f7d02a0acc9457cfef726a7b8201b81e3c3c39e024cb68dedd
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mz8kOvRwg4tzhvEWg:e9C0Xgfe2Drg4tdv5g
TLSH
T1D2253334B10364B2F0B80A74095B6EC1963A34751EF02523FB04DBEBED795E5F9B2299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	3084	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_5e5368712da6718a41b3171d3d3724ec_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-23_5e5368712da6718a41b3171d3d3724ec_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_5e5368712da6718a41b3171d3d3724ec_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 404
  2⤵
  - Program crash
  PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3084 -ip 3084
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3084-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3084-1-0x0000000000400000-0x000000000042D000-memory.dmp