f11417cbfd1a41e3e564258aa25432c8bbdf35f5fd78de10de3ccdb2115c251d

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4351bacee734370572191a58c58fe9cd_elex_wannacry.exe
Size 332KB
Sample261024-sgpmnavwcy
SHA256 f11417cbfd1a41e3e564258aa25432c8bbdf35f5fd78de10de3ccdb2115c251d
MD5 4351bacee734370572191a58c58fe9cd
SHA1 13f2f4deece7e43ecf0c8b9ddf2206685c42583d
SHA512 f5b5ace46630eb18c991d9cb1e886575d7b6f48f085f5509eeea6a2fc3851ae45ff29d219bc5a6a30ddb59992bd1f708ab2622bee414223978f2565c92c79357
SSDEEP 3072:POXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7k7txIYmzn/HEe+IV/:MvGlpQEQAMtqNUzCxtxIVzn/kdIqAHJv
TLSH
T18C748E82D6768AC1D818CD30159634E517FF2C0334075E53F76BBF2E29BAE90BA4E661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	1888	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4351bacee734370572191a58c58fe9cd_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	2026-10-22_4351bacee734370572191a58c58fe9cd_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4351bacee734370572191a58c58fe9cd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4351bacee734370572191a58c58fe9cd_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 492
  2⤵
  - Program crash
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1888 -ip 1888
1⤵
PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1888-1-0x0000000000400000-0x0000000000453000-memory.dmp