3d1b67b555db6c92bb800c9a4e23099038a66fae1d6b9801c9d380febb3da1d7

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_49219e4cb347b0ad694d30ffe411e71c_elex_wannacry.exe
Size 1.0MB
Sample260523-wpqfpsf19l
SHA256 3d1b67b555db6c92bb800c9a4e23099038a66fae1d6b9801c9d380febb3da1d7
MD5 49219e4cb347b0ad694d30ffe411e71c
SHA1 b1e1dcaf23d6e753bc3884b8c9bc6838c907ad95
SHA512 8c3f6ccd88b5be46c21584c0fb2c1abc89e5adfad695ce242ef7fcf1df6536d96969ee9fe5971b070d512de8ca3209ebc96b84baff56a64ee8f2e5a8cf84f83b
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mz8Or3hAvLhuLhIL:e9C0Xgfe2DhrsLhghIL
TLSH
T135253335F103A0B5F2A10FF10F691D805A3E717519B56827EB84CDAA6EBBEE1F13114A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	5340	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_49219e4cb347b0ad694d30ffe411e71c_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-23_49219e4cb347b0ad694d30ffe411e71c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_49219e4cb347b0ad694d30ffe411e71c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 416
  2⤵
  - Program crash
  PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5340 -ip 5340
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5340-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5340-1-0x0000000000400000-0x000000000042D000-memory.dmp