96b5f0d15f73d9ef4235098898cdb4090e7b2528ca6313339296162d656f6e21

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_7d3aafd8303cc989de3bb89837e52def_elex_wannacry.exe
Size 92KB
Sample260727-ty4ctaxakf
SHA256 96b5f0d15f73d9ef4235098898cdb4090e7b2528ca6313339296162d656f6e21
MD5 7d3aafd8303cc989de3bb89837e52def
SHA1 a8718ba5171134037882521deab749ac1c90d7ac
SHA512 1a4b71047dacfc963d597baa36ddfb9d13bf52c48e5ebe1b1c803b8615f0987992c623509d78d22f99aff82a79918fd199229a49f14b0e39cc23edbd3d212dbb
SSDEEP 1536:9Lvw5PboEymOiMF2DrqKllgI+nt+WsjdpnI9+MBgOrfyrz:Rw5Pc+OP+rqKbgbntbsjdK97BgOo
TLSH
T10493E13BF342AC76E086467069962AF2523DBE3055247B03DF508C469DB99FEE53020B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	2728	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_7d3aafd8303cc989de3bb89837e52def_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d3aafd8303cc989de3bb89837e52def_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d3aafd8303cc989de3bb89837e52def_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 452
  2⤵
  - Program crash
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2728 -ip 2728
1⤵
PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2728-1-0x0000000000400000-0x000000000042D000-memory.dmp