85ae52f12d93d5668245ac038ef82b8f3a989a49f09aa6bc4a917ce601590039

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_7abde18b4ecb6e656fc2b043adec7537_elex_wannacry.exe
Size 916KB
Sample261011-mm5ceahs3p
SHA256 85ae52f12d93d5668245ac038ef82b8f3a989a49f09aa6bc4a917ce601590039
MD5 7abde18b4ecb6e656fc2b043adec7537
SHA1 cf75b7053431eee536bf2e861b7f01db9a9838ad
SHA512 8c186fdf204fa837d0ebd2165a07f4597ecdf9a27b1860e5d3db07afaa0944bde6c595b7cf7ff9dde141b00dd5101a521972ab8b8a46c285bb205ef1b7c1ed4e
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVbOXkFX5:e9C0Xgfe2DRe+rZVbN
TLSH
T151152338F303C4B5E06D5DB20A6D5CD0AB3631351EF46003E7899AB76E7A9D7E03A195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4836	6140	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_7abde18b4ecb6e656fc2b043adec7537_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-10_7abde18b4ecb6e656fc2b043adec7537_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_7abde18b4ecb6e656fc2b043adec7537_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 460
  2⤵
  - Program crash
  PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6140 -ip 6140
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6140-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/6140-1-0x0000000000400000-0x000000000042D000-memory.dmp