04762f5dd21ef815448a81e0a38492186d6aa9fa0b6b46d0f3b24c7b3dce876d

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b1c8dba1afab1c01f22a523834f8cda9_elex_wannacry.exe
Size 83KB
Sample260814-s2mnssxtds
SHA256 04762f5dd21ef815448a81e0a38492186d6aa9fa0b6b46d0f3b24c7b3dce876d
MD5 b1c8dba1afab1c01f22a523834f8cda9
SHA1 a75914aef780672f0ad46e29da8d6f8f1ba9b9b3
SHA512 0aa0dbc6c46cf2a59e9aaad473f428ce7d2d08b689b58950bfdf19433928ef644ed1d63d35c529b6292762e305a56ce77c32b7ac583bfac863ed508910a2c652
SSDEEP 1536:9Lvw5PboEymOiMF2DrqWTIX7Tw5jO2GoJB3NZeYmXh4lllgI+nt5:Rw5Pc+OP+rqWTnO2Go7rIx4lbgbnt5
TLSH
T1EF83D03FF3922DB5E4D709755C9A2EE2967DBE300A653A07CF44888B4D709EAB130157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	1288	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b1c8dba1afab1c01f22a523834f8cda9_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b1c8dba1afab1c01f22a523834f8cda9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b1c8dba1afab1c01f22a523834f8cda9_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 448
  2⤵
  - Program crash
  PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1288 -ip 1288
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1288-1-0x0000000000400000-0x000000000042D000-memory.dmp