35da4c2eb5f5b919b93ad3ff40f51ff6cdc7d769a10bf7103fe9ba5d2e5e2ca7

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_9ba86cae99f5b518caccac73880b9d8c_elex_wannacry.exe
Size 192KB
Sample261018-258j4sty5p
SHA256 35da4c2eb5f5b919b93ad3ff40f51ff6cdc7d769a10bf7103fe9ba5d2e5e2ca7
MD5 9ba86cae99f5b518caccac73880b9d8c
SHA1 8fb1f552b855e4aca36f5c5ff0749a6169b99a39
SHA512 7388f1d637d919a104c8ab463df44d0324ea993234e81f861a552efd467a267cca5f9da884fa5918485ff68f97052cf768c7061a79ad4a581057384f6de617a3
SSDEEP 1536:1QY+2d4I6wSIpLRrPXnLWhw5PboEymE6f:CY+2d4I6wSIpLRrPX6hw5Pc+E6
TLSH
T160147C3FB3821DBEC0E40472295656B32778BD305AB5B907FF58494B4EB1AEEA430217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3400	3616	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_9ba86cae99f5b518caccac73880b9d8c_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-17_9ba86cae99f5b518caccac73880b9d8c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_9ba86cae99f5b518caccac73880b9d8c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 256
  2⤵
  - Program crash
  PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3616 -ip 3616
1⤵
PID:5780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads