f96f63384b7101c12dfb7f15100a506f6d09e048fa479828893b6317b591f2da

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_2922ad5bc8e739e1e9a76c84c38efd43_elex_wannacry.exe
Size 2.1MB
Sample260710-bt375scz2w
SHA256 f96f63384b7101c12dfb7f15100a506f6d09e048fa479828893b6317b591f2da
MD5 2922ad5bc8e739e1e9a76c84c38efd43
SHA1 82eee4c17ebf4d7cee1365a798ad8dd0dc8b952b
SHA512 8937e41125d4f1bbefd81dc7827c4d3db8613b6da6365ec96642ce977bc02df6e8c4b8b36f2d256d9e2846266c1e3cb8595692a2abc9545c50055bda705f8f76
SSDEEP 49152:e9C0X5pR8AbNcqQtDybOzb4AOd9CGpoobW0IduADea:epv8ABcqUJzrOd9CGpBbWaAp
TLSH
T173A53370E782B87AF5F404BB46E778E02B703F994C666337853149C29FA53A8D676807
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	4832	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_2922ad5bc8e739e1e9a76c84c38efd43_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_2922ad5bc8e739e1e9a76c84c38efd43_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_2922ad5bc8e739e1e9a76c84c38efd43_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 460
  2⤵
  - Program crash
  PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4832 -ip 4832
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4832-1-0x0000000000400000-0x000000000042D000-memory.dmp