ced8a838ffb384cc5daefeb25059dd34d0f5af5ba3204fee66332f2ed2a43702

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_680107b201a365aff9ac576ec147b11c_coinminer_elex_upatre_wannacry.exe
Size 28KB
Sample260806-stl3asel4s
SHA256 ced8a838ffb384cc5daefeb25059dd34d0f5af5ba3204fee66332f2ed2a43702
MD5 680107b201a365aff9ac576ec147b11c
SHA1 653784f0bc4defc335e354b4af36891f26c315e1
SHA512 6995e66c2340d8197b2ca943aec0d2cc54f13b9c211595a7e8fd4427566305301e272862c4a221dd734ca8b685f31597a9d240d3c41c7ece033680024afe7ef2
SSDEEP 384:gGz3qWcd5DUVQQcM+JKcMef9RlLRhQIUY/FYHZxgO8vixamynIsfb:tz3qWc7Rx1JeO7hpFwxgOTE5jf
TLSH
T14ED2E7DED9864589CC853E7B92FE5B0091149E0D87A55AE7E9A8FC438D7E3C14C31C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	1300	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_680107b201a365aff9ac576ec147b11c_coinminer_elex_upatre_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_680107b201a365aff9ac576ec147b11c_coinminer_elex_upatre_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_680107b201a365aff9ac576ec147b11c_coinminer_elex_upatre_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 264
  2⤵
  - Program crash
  PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1300 -ip 1300
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads