eddecc4604736452f7c0ec230a481e2bb9df43cbabb5a32b63813e054d708349

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_89aa99cfb6040d07fad4efa33b7516a8_elex_wannacry.exe
Size 2.0MB
Sample260703-da59haav9v
SHA256 eddecc4604736452f7c0ec230a481e2bb9df43cbabb5a32b63813e054d708349
MD5 89aa99cfb6040d07fad4efa33b7516a8
SHA1 578e2c35c9c4220b2711e822de1f9f760367b017
SHA512 be7f119ebe9b58e899105e0c04d6d09fdb0afc9f2b47eb0cf7a0d2131fd75bfc2e2e1859b0e62504303f8d6fc19bb4d95211aa3914fabbe9283e533c460c0f29
SSDEEP 49152:e9C0X5pR8AbNcqQtDybOzb4AOd9CGpoobW0Id2nqR:epv8ABcqUJzrOd9CGpBbWy+
TLSH
T1C2A53370F7827CB8F1A844BB42AB7CD06B703A950C666337993145C29FB87E8D572923
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	1792	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_89aa99cfb6040d07fad4efa33b7516a8_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_89aa99cfb6040d07fad4efa33b7516a8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_89aa99cfb6040d07fad4efa33b7516a8_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 456
  2⤵
  - Program crash
  PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1792 -ip 1792
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1792-1-0x0000000000400000-0x000000000042D000-memory.dmp