55f266120d613c025d9e10c27a214151a26499e6a64616a8ccbb2cf8990c855d

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_450600c349e4129d8d2cbd939bc18f31_elex_wannacry.exe
Size 841KB
Sample260628-2ylf1agy2n
SHA256 55f266120d613c025d9e10c27a214151a26499e6a64616a8ccbb2cf8990c855d
MD5 450600c349e4129d8d2cbd939bc18f31
SHA1 05f0067f54185f1cae4e6f3c8c27c7b7df5f406b
SHA512 f09bf5e3d38d063fd9610267319b3b414ae2f984c600b70a169cd2b43092d156c93b544687f5c05b7875d882b7afad3de5394760ee64b7378e08d4b3b3268330
SSDEEP 12288:Qy99FKT20YUT2B6uZ7B6uZhZfKE2cjZHT4xIqaKlBaKBHbtwqqTywc0:L93KC01T2B6CB6ebZzNiDH5wqoyM
TLSH
T126052368FA912C7DE84305B219E75AE12F35A8BA9513BB3FD774400B2FB16C583717A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5648-0-0x0000000000400000-0x0000000000431000-memory.dmp	UPX
behavioral2/memory/5648-1-0x0000000000400000-0x0000000000431000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5648-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/5648-1-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	5648	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_450600c349e4129d8d2cbd939bc18f31_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-28_450600c349e4129d8d2cbd939bc18f31_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_450600c349e4129d8d2cbd939bc18f31_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 452
  2⤵
  - Program crash
  PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5648 -ip 5648
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5648-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5648-1-0x0000000000400000-0x0000000000431000-memory.dmp