86a938ed5778dca63fe3a70fba22a018e0801ee55d3358dc4f897ee015a53a28

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_248ece270b5e81f61c416e04a3b7b738_elex_wannacry.exe
Size 744KB
Sample260730-ede26asvd1
SHA256 86a938ed5778dca63fe3a70fba22a018e0801ee55d3358dc4f897ee015a53a28
MD5 248ece270b5e81f61c416e04a3b7b738
SHA1 03b9b8b7e3358781667edc37f940c142f337c4bd
SHA512 4d1d9f62f367173881a230344fdcb16b47c14d74af0e7580dbf46eedffbcd1863d0b535e7b779dbda3e81757ce4a60a7a4a2ec5f246b47aaf3d56ea35fe96aea
SSDEEP 12288:ry99FKT20YUT2B6uZ7B6uZhZfKE2cjZHT4xIqaKlBaKspw27qZGKcAKieti5:e93KC01T2B6CB6ebZzNiDR2+ZRdpui5
TLSH
T1BEF4231AF9615C3FD80204B26CD705E20B75BEFA6683FA3BCB74000B6E756C557B1AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	2872	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_248ece270b5e81f61c416e04a3b7b738_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_248ece270b5e81f61c416e04a3b7b738_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_248ece270b5e81f61c416e04a3b7b738_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 412
  2⤵
  - Program crash
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2872 -ip 2872
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2872-1-0x0000000000400000-0x000000000042D000-memory.dmp