Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 20:26
Behavioral task
behavioral1
Sample
2026-07-30_7c72083fa98dc2aa8651c5a85c71e6b9_elex_wannacry.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_7c72083fa98dc2aa8651c5a85c71e6b9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-07-30_7c72083fa98dc2aa8651c5a85c71e6b9_elex_wannacry.exe
- Size 192KB
- Sample260730-y8ceasfc26
- SHA256 4545d6ecf1837112aeb90faefdaa687d6f13e22e27ab4841786086f7b7856acf
- MD5 7c72083fa98dc2aa8651c5a85c71e6b9
- SHA1 e38de417ac9ed51ba285575833c21d8af7cb9487
- SHA512 6cb13862bd7d7888fa75bb6625f78d743b5e0d7ffbc74d9c7a36f158292097665f5f39538df3f4c099b28bfd8d0663cb347d69da36f30b9798d7c72ffb33b75e
- SSDEEP 768:1nMdJF/7viwBIpR8NtRqQZzabLE9mZ7mYrPSLN4b6gF:1QJF/7viwBIpR8NtR5zaboEymE6f
- TLSH T1C0146C3BF3C21E7AD0E40076264796F22239FD305AB5B607EF584A0A5EF22DDA531257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 4060 424 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_7c72083fa98dc2aa8651c5a85c71e6b9_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_7c72083fa98dc2aa8651c5a85c71e6b9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7c72083fa98dc2aa8651c5a85c71e6b9_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
PID:424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 2642⤵
- Program crash
PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 424 -ip 4241⤵PID:5600