23e22cfb4b3d4da18d2d212019e4e7afb17baca51d27995784fa276b8931b3ae

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_4dcb3a9178bc5aed761ed4933a01b873_elex_wannacry.exe
Size 947KB
Sample260916-1mt4bsef57
SHA256 23e22cfb4b3d4da18d2d212019e4e7afb17baca51d27995784fa276b8931b3ae
MD5 4dcb3a9178bc5aed761ed4933a01b873
SHA1 d9026ece8ddc24b6bf29c6fdecbf1e599387aaab
SHA512 4ee5bb79700b4da5620f3a9bedfde222d7def113f50ceec1b74ec24d282bbb2932e4d77cc1095cafe922d5e02951713ba2e33bf0d360c930b956c0fee91a398a
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVb3/j/rCV/W5yp:e9C0Xgfe2DRe+rZVb3r/+QMp
TLSH
T1DB253338F2038035D02D4D720BAA6980AB7631361DB16413F7859AB7AE7FBD7F178685
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	3376	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_4dcb3a9178bc5aed761ed4933a01b873_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-16_4dcb3a9178bc5aed761ed4933a01b873_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_4dcb3a9178bc5aed761ed4933a01b873_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 452
  2⤵
  - Program crash
  PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3376 -ip 3376
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3376-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3376-1-0x0000000000400000-0x000000000042D000-memory.dmp