dec11844cece0daf6fd334f2cbb7d94a1ebf76161ac644671a4c309d5960d3d1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_ac1a3a6f71fc0b93d0e7de56d7b3b83a_elex_wannacry.exe
Size 899KB
Sample260602-dngs3ady7k
SHA256 dec11844cece0daf6fd334f2cbb7d94a1ebf76161ac644671a4c309d5960d3d1
MD5 ac1a3a6f71fc0b93d0e7de56d7b3b83a
SHA1 5eea68a1919d5f798b3bd476214cfdc56a52a898
SHA512 f932b38398399370357a64d2da55440806b4331b09ea2d4650bcddec16a4d3833e5f35f953de2f7fd9a58973a528447de78ae8aae0525bf6be668dc01c870215
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVbjVQSdr:e9C0Xgfe2DRe+rZVbjCUr
TLSH
T103152338B203C471E06E19770BA95CD09B7671350EB46017EB85DA6BED7ABDBF039281
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	3828	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_ac1a3a6f71fc0b93d0e7de56d7b3b83a_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-02_ac1a3a6f71fc0b93d0e7de56d7b3b83a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_ac1a3a6f71fc0b93d0e7de56d7b3b83a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 416
  2⤵
  - Program crash
  PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3828 -ip 3828
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3828-1-0x0000000000400000-0x000000000042D000-memory.dmp