d2e327c07994290daafcf0b3ce5c48fd5524bb6ad045979e6baea68a7a8d2a18

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe
Size 20KB
Sample260928-ezjbpsvbph
SHA256 d2e327c07994290daafcf0b3ce5c48fd5524bb6ad045979e6baea68a7a8d2a18
MD5 77b462a15d4f85869a194e894185c706
SHA1 6bd9e87c7350c74d07485081062f804347e8c2de
SHA512 082ccb4b25b6be706f8cb2dc2b3aa1172df264bb39a6bf08b2d8bc54ac58bfc7d74d73491dcb7439c0d3de1671fc5d64382a3855fd17ac5c5b1955443071c0b7
SSDEEP 384:mOqWi+jkI8bnxc3Y6p0p3TfOlYt4hYfyRq:mOqXnxc3Y6p0kYqhYfyRq
TLSH
T1919208E56F6812B0E80D847540ABD7769933A414272D591E0FFBDC5BFC231418EBA74E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\s13k.¿ÿüÞ¦«ºÇ±C:\Users\Admin\AppData\Local\Temp	2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe
File created	C:\Users\Admin\AppData\Local\Temp\s13k.1«ºÇ±C:\Users\Admin\AppData\Local\Temp	2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1140	2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe
1140	2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_77b462a15d4f85869a194e894185c706_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-0-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/1140-1-0x0000000000400000-0x0000000000404000-memory.dmp

Download