704b40eb90e565cec877248a373c7a96715b3b739fa1dfe92116f54e13480d70

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacry.exe
Size 123KB
Sample260912-3ebm5abf76
SHA256 704b40eb90e565cec877248a373c7a96715b3b739fa1dfe92116f54e13480d70
MD5 74cd334ba08f6db8a05dd6db14fac51f
SHA1 a097734bf2f4fe12cf5fc22d07e91572dab05d0f
SHA512 9c018b0a3174f24f08450be9c8ad92dc39d56a4a4eb9862d9c81782bda150c39e0aaf841e5232ee6e75be0387ba113a4899a36ba09b5293f9cb1e450609c4f96
SSDEEP 1536:ipWUmkrH6b2eQdvjR+v+xfHTrVPoZ6E8MamI72REccvCH1RQl1xf1l1:iJmkrw2RtcW5ru7rVovcKlj31
TLSH
T17DC3E0168970203BFF589EB1F99B7E0112F61A29844797CA4450EBB437A6D439DF8E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3800	2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacrymgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4444	3800	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacrymgr.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3800	4656	2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacrymgr.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacrymgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 436
    3⤵
    - Program crash
    PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3800 -ip 3800
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacrymgr.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_74cd334ba08f6db8a05dd6db14fac51f_amadey_elex_ramnit_wannacrymgr.exe
Size 106KB
SHA256 f6fbf8ddf2d0f518af358cf35bece264e6ed601546eb50984a8e456a74e190ad
MD5 57a2a853f46fce37b403d054949212d0
SHA1 41fadb0f89c5010dd40d407d72cb5300303cf356
SHA512 6c21f433437f32537c8cf514de8c372cf6a84717b0be0c3c81d5d48638d4e533df536f12e6013cbfd6a493bbfb17a4c0abc456685181eefbfd04cf1d7ded5b3a
SSDEEP 1536:j+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ0m:j+FDzK71QkbstyJjCKICpC72s/mlaXh
TLSH
T15BB3E166F79908D2D2848B3B878AAD70CE457D23494B10F589843FBF9D37D01B56C27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3800-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4656-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4656-8-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads