f6fc43ab45ba6c393bed70d429c20fe2f07a4adb4506cf7f113bd9d71c549e0d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_6402c7e039d3dfa2133f3148b4dc97b8_elex_wannacry.exe
Size 96KB
Sample260814-tc6aaaek2v
SHA256 f6fc43ab45ba6c393bed70d429c20fe2f07a4adb4506cf7f113bd9d71c549e0d
MD5 6402c7e039d3dfa2133f3148b4dc97b8
SHA1 1aaf72c54ed220bd08ad6b590141353b80659c03
SHA512 1feaa79e19dd1a9bb7f8914c8637a9ffa133e2371b7ef03b6083c44c5d5329a0becf4f860a062fd0a1ed288fe15a9c4f1d28ab637b59c00b7c6b2859f16a7ea1
SSDEEP 3072:Rw5Pc+OP+rqcWHbgbntW5n2ThWsNexPnCrnrrHFe:qIP+rqcWHbSankP+6brzo
TLSH
T1F7A3E13BB3831C76D49614329AE626F2167DFE3059517E13DF40695B4EB09EAE13032B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
124	1324	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_6402c7e039d3dfa2133f3148b4dc97b8_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_6402c7e039d3dfa2133f3148b4dc97b8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_6402c7e039d3dfa2133f3148b4dc97b8_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 460
  2⤵
  - Program crash
  PID:124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1324 -ip 1324
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1324-1-0x0000000000400000-0x000000000042D000-memory.dmp