a9011e85f7d76266d3e7dc5718b659c74dc4b38644000277a93873caca92638d

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_4d3aaccf9c9b9935cfd65794ec2f94ab_elex_wannacry.exe
Size 335KB
Sample260824-pfa64axdnd
SHA256 a9011e85f7d76266d3e7dc5718b659c74dc4b38644000277a93873caca92638d
MD5 4d3aaccf9c9b9935cfd65794ec2f94ab
SHA1 8533bccfb5cd9f8db9dfe2861600dbfa05dc635c
SHA512 da52a508f87fce97b00c3f30c301c6252d2e604aff61c21354e00981595a61dc5ff8b472ef0920fab2335c972caad83da3c10a6c65ef25fd5744306ea835ef21
SSDEEP 6144:1pFbYiTO/Vo8wjOm6JMRPzyZCJeNnTImk9dKacFK8CNjfYT4kF:VciTO2PE2QC00me2VCN7YT
TLSH
T15C74D01332D048F6E5853633CD76BEB4E3EAD1AC8D32DABB6F98051C1E3590597122AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
416	4348	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_4d3aaccf9c9b9935cfd65794ec2f94ab_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_4d3aaccf9c9b9935cfd65794ec2f94ab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_4d3aaccf9c9b9935cfd65794ec2f94ab_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 280
  2⤵
  - Program crash
  PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4348 -ip 4348
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-0-0x0000000000400000-0x0000000000455000-memory.dmp

Download