756db6651de7d45396fd68279d39058f8a5b3a461ed85cbc20146472f7ffcad8

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_bc6a1b2395b48558208b6a088dd0da4f_elex_wannacry.exe
Size 848KB
Sample260527-wpthcsg15s
SHA256 756db6651de7d45396fd68279d39058f8a5b3a461ed85cbc20146472f7ffcad8
MD5 bc6a1b2395b48558208b6a088dd0da4f
SHA1 f84304c9d3df66d059a0809f99c1a5b63cdcfe8c
SHA512 40104726c8417105e18efcf7759de54f12928383ec15f99b9e382a95cc6c2bb25346b1bbe5273e4b7c6797ade26da2b2882e4588722b4922e20e7df2ddfb74c6
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVbIhhW:e9C0Xgfe2DRe+rZVbOM
TLSH
T139052339B203D075E1590DB20E7A5DD0EB7B71354EB16003E74489BBAE79AE6F03A385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	3260	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_bc6a1b2395b48558208b6a088dd0da4f_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-27_bc6a1b2395b48558208b6a088dd0da4f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_bc6a1b2395b48558208b6a088dd0da4f_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 424
  2⤵
  - Program crash
  PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3260 -ip 3260
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3260-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3260-1-0x0000000000400000-0x000000000042D000-memory.dmp