325080d17af9301201f5b261970d1d6d0e3b884786661857d799ae628b145496

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_5983cca89f6ec890e98c616f5ac8a71a_elex_gh0st-rat_scribble_strictor_virut_wannacry.exe
Size 152KB
Sample260710-e4kekacz9m
SHA256 325080d17af9301201f5b261970d1d6d0e3b884786661857d799ae628b145496
MD5 5983cca89f6ec890e98c616f5ac8a71a
SHA1 3ccc13b670feca6696f3dadd4b4c7bd8d5bc983e
SHA512 851ff8353623c68ae69a89a52fb12d8827dbb54f6ff7c9541689e97d9156f2cd3c57547137669756f9beca79a60e131841cdaf3718f8388dee9fc0ca76daed2d
SSDEEP 1536:fJdMmJyDl+tIZboZyH1mgE+Uqn3Z6Vl2r:fJuIyDpZMyH19tJJqlY
TLSH
T1EAE3CF83FA9500F1E416903C387A97BA6A7B98B54B1FD163EB40DDCC2C34719EB79219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/5352-0-0x0000000000400000-0x000000000042B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5352-1-0x0000000000400000-0x000000000042B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	5352	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_5983cca89f6ec890e98c616f5ac8a71a_elex_gh0st-rat_scribble_strictor_virut_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_5983cca89f6ec890e98c616f5ac8a71a_elex_gh0st-rat_scribble_strictor_virut_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_5983cca89f6ec890e98c616f5ac8a71a_elex_gh0st-rat_scribble_strictor_virut_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 428
  2⤵
  - Program crash
  PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5352 -ip 5352
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5352-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5352-1-0x0000000000400000-0x000000000042B000-memory.dmp