23439c88c7ac699b0b79b017e7ff4ee80ca71da29ba745d35c7b0568c909e811

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_a51fb8dcf6e067b4bd820f8950606d45_elex_wannacry.exe
Size 619KB
Sample260529-bft3bafw2v
SHA256 23439c88c7ac699b0b79b017e7ff4ee80ca71da29ba745d35c7b0568c909e811
MD5 a51fb8dcf6e067b4bd820f8950606d45
SHA1 52096a0017890171186f7ba9b0376d961180d198
SHA512 7416cb106cde6058f43814ed666ae43afe93dba397bd2b70f9a070b939d6a66f3eeb72c7fc8b718e658d67429b70e015bd8d5513602da57bb469c27ae425ba00
SSDEEP 12288:ry99FKT20YUT2B6uZ7B6uZhZfKE2cjZHT4xIqaKlBaKBHbeyewo:e93KC01T2B6CB6ebZzNiDHNXo
TLSH
T1BDD4234DBBB21C3DE84204B52E5706F51F75F8BB9663AB37C7B0080B6EA06C99372654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	5648	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_a51fb8dcf6e067b4bd820f8950606d45_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-29_a51fb8dcf6e067b4bd820f8950606d45_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_a51fb8dcf6e067b4bd820f8950606d45_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 416
  2⤵
  - Program crash
  PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5648 -ip 5648
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5648-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5648-1-0x0000000000400000-0x000000000042D000-memory.dmp