e5ad51a1c162d3452d3af155dbc3998b3411a29a0e3c85ccec253c3ae62ea7b3

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f908725d758cdcb9d2c9890b221f4c55_elex_wannacry.exe
Size 2.0MB
Sample260709-d8dbdact2j
SHA256 e5ad51a1c162d3452d3af155dbc3998b3411a29a0e3c85ccec253c3ae62ea7b3
MD5 f908725d758cdcb9d2c9890b221f4c55
SHA1 3ba71f572659a86f5fbe6fa02a28627ee6293461
SHA512 5d92932a70c295cb564908bfa8ed6ad7302744b16824a733a16fc9ccdf883ce1aa8e9a843b5141624f71ce6e64ee4b5437ca59d3bd272882ae63a8017cd2741c
SSDEEP 49152:e9C0X5pR8AbNcqQtDybOzb4AOd9CGpoobW0IdusBP8N:epv8ABcqUJzrOd9CGpBbWasBP8N
TLSH
T1E0A533B0BB52BCB9F6B840BB46E77CE06B702ED51862633B452145C29F747E8D672423
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3440	1040	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_f908725d758cdcb9d2c9890b221f4c55_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f908725d758cdcb9d2c9890b221f4c55_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f908725d758cdcb9d2c9890b221f4c55_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 396
  2⤵
  - Program crash
  PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1040 -ip 1040
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1040-1-0x0000000000400000-0x000000000042D000-memory.dmp