68ddbb9951843d1ea72580b9cdb4f3818044d918b49f02034ed42f7b3222b048

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f378e75b4c671e37c88cb57d69f3b771_elex_parallax_remcos_remocs_wannacry.exe
Size 128KB
Sample261023-c19h6sbw3q
SHA256 68ddbb9951843d1ea72580b9cdb4f3818044d918b49f02034ed42f7b3222b048
MD5 f378e75b4c671e37c88cb57d69f3b771
SHA1 344b390102df2ef0a0cad4741547716675887265
SHA512 39080aa026a1aff2f3e19b6f3d620a09d9f9f1b76ede900b606ac395d0474522117d3da6f7668f9df5e928ead776460454c2e0d49867156185b039d0dcb53dfe
SSDEEP 1536:9ITo5Q31znm0Io3heGqug/KnD2c0Kr6yI5EFF5Y+zqh7lMqna0E:uT2QtmjGqug/+D2c0yNIAF5Y+zQMqd
TLSH
T1CDD319077606AAE3E81505B017C03F96CBFCAC2306D665A3C35AD2D11DB586AF076A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	5436	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_f378e75b4c671e37c88cb57d69f3b771_elex_parallax_remcos_remocs_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f378e75b4c671e37c88cb57d69f3b771_elex_parallax_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f378e75b4c671e37c88cb57d69f3b771_elex_parallax_remcos_remocs_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 580
  2⤵
  - Program crash
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5436 -ip 5436
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads