cbd5f8f8016b54fa651fc65dbba44e0f759094f052bab882d4055ca761b55704

Analysis

max time kernel
149s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_e999f0f4ecb69991aed5e45df05a128a_elex_wannacry.exe
Size 1011KB
Sample260629-b416jaaw21
SHA256 cbd5f8f8016b54fa651fc65dbba44e0f759094f052bab882d4055ca761b55704
MD5 e999f0f4ecb69991aed5e45df05a128a
SHA1 49d50b55a289ce4f6ff4a85750d4a283b968f098
SHA512 c4d7e21eefcd78f5e21699201000b8e98f07ebace6f6c9abb93d06205c374be50acbf6237659722510a902097d6899f5e150b7eefb0cbd6031ad62a1d1d53135
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVbjtbgH0Dj/qkQ:e9C0Xgfe2DRe+rZVbjtbgHej/o
TLSH
T199252335F20394B2E02E5D730A9919806F7671764EB46017E789DAABBD7DAC2F13D380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1844	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_e999f0f4ecb69991aed5e45df05a128a_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_e999f0f4ecb69991aed5e45df05a128a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_e999f0f4ecb69991aed5e45df05a128a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 392
  2⤵
  - Program crash
  PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1844 -ip 1844
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1844-1-0x0000000000400000-0x000000000042D000-memory.dmp