6dad23b85a0a2987aa7a54a8980b14c0b24c1eb4e5034d8c6f58326430136e39

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_dd15cf12f20c64e7916bb6faf9f68200_elex_wannacry.exe
Size 404KB
Sample260729-rdb2qahd89
SHA256 6dad23b85a0a2987aa7a54a8980b14c0b24c1eb4e5034d8c6f58326430136e39
MD5 dd15cf12f20c64e7916bb6faf9f68200
SHA1 646c5aa69d9d6705f39098e38de2d4c701e4f188
SHA512 0e102fd62d465a847ce64b8c6820f1d72e0b74314a15f3769d308d84e3c4c9f80ffcfb8898fe1798e4e7a71b1cb9982d0ea4f7a9560608b6c68c3d38fe1f6fee
SSDEEP 6144:qIP+rqKbSOJFKzH2IIThAYrYfrQRT4gTko6uZ7ko6uZhfPc61dtZOKfTiJTPgJI:ry99FKT20YUT2B6uZ7B6uZhZVfTyTPg6
TLSH
T19E94231AE7D17C3ED48284B21B560CF1077EBEBA5262BA37DB1048472E704D9E772A74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	4980	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_dd15cf12f20c64e7916bb6faf9f68200_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_dd15cf12f20c64e7916bb6faf9f68200_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_dd15cf12f20c64e7916bb6faf9f68200_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 448
  2⤵
  - Program crash
  PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4980 -ip 4980
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4980-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4980-1-0x0000000000400000-0x000000000042D000-memory.dmp