613a80bac5afbd2ebdbe2396420fb1c367108031aec0215ddf8f92121f0f1c94

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_1f6ef4a78badb6babff95d75d9a51f76_elex_wannacry.exe
Size 764KB
Sample260628-3z7lashx4m
SHA256 613a80bac5afbd2ebdbe2396420fb1c367108031aec0215ddf8f92121f0f1c94
MD5 1f6ef4a78badb6babff95d75d9a51f76
SHA1 70d88f4853494e251df1fe4e960864e7948dd9a3
SHA512 19d41a6e87cdfaf4b6b617a55e521edb98c8b5e6043f3137052ca022ddd261850e7feb53a27452de4b6cbbfbcff9dce431e483518cb2dafcad6e72a88378e823
SSDEEP 12288:Wy99FKT20YUT2B6uZ7B6uZhZfKE2cjZHT4xIqaKlBaMU6Iopk8X5iIW5:993KC01T2B6CB6ebZzNiDY6r6Q5iIw
TLSH
T155F4231CFA622C3DE44204761D4B8EF51B34B9BFE262B736CB6040476EF06DA9275B94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5592-0-0x0000000000400000-0x0000000000431000-memory.dmp	UPX
behavioral2/memory/5592-1-0x0000000000400000-0x0000000000431000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5592-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/5592-1-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4204	5592	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_1f6ef4a78badb6babff95d75d9a51f76_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-28_1f6ef4a78badb6babff95d75d9a51f76_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_1f6ef4a78badb6babff95d75d9a51f76_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 452
  2⤵
  - Program crash
  PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5592 -ip 5592
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5592-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5592-1-0x0000000000400000-0x0000000000431000-memory.dmp