e856eec5750f9344f439315bfe878391b7e2523819b43c1e221d96c4d48e36a1

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6d290d08e09c480a0110dce21a50dde7_elex_ramnit_wannacry.exe
Size 168KB
Sample260701-e39ytsgs9y
SHA256 e856eec5750f9344f439315bfe878391b7e2523819b43c1e221d96c4d48e36a1
MD5 6d290d08e09c480a0110dce21a50dde7
SHA1 f5b3681f02899afaf32dbcd126a2dfa64be95f4d
SHA512 b025772bf534ee2f50380dc2bb5d7d656725e9455d3be3b93e2e5f31db8c66eca3006a4f3c863c5a3e3c35f9acc9db1bcb6bc3772e37f7afcd450adafa8a6b03
SSDEEP 3072:NJyB5M6Kth0vc+1RpnLy1KmstjstBeUda+5GCQ:NJyXYSp1jnLwjBBou3Q
TLSH
T13BF3698A914EA6DEC35341B33D155F2872951DA810E918CFFEC03857BF3B1969DAF242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_6d290d08e09c480a0110dce21a50dde7_elex_ramnit_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6d290d08e09c480a0110dce21a50dde7_elex_ramnit_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6d290d08e09c480a0110dce21a50dde7_elex_ramnit_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download