96c645eb3f692e7c03d1f690eb08517d38a0eb85867249ac832948022413c9af

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c4b354105b289de398b3dac8a1045a97_elex_wannacry.exe
Size 979KB
Sample261029-xt332afw2p
SHA256 96c645eb3f692e7c03d1f690eb08517d38a0eb85867249ac832948022413c9af
MD5 c4b354105b289de398b3dac8a1045a97
SHA1 d224f52a1563dc5a92c604b8b70ec417646c881b
SHA512 c360d4558cc011bbc59e214025ab95436bd2c46633fadb91460984376cfb8d13aea28a871a5130d42e5ef2673578a2c39a553691cbe7648a2ea5043bc5241f99
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mz8kOvR3PMMig3P5:e9C0Xgfe2D+R/5
TLSH
T149252335B20390B2F5580A720EAF6FC5B63A303119B17457E700DAEBFE3B695E570296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	4076	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_c4b354105b289de398b3dac8a1045a97_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b354105b289de398b3dac8a1045a97_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b354105b289de398b3dac8a1045a97_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 452
  2⤵
  - Program crash
  PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4076 -ip 4076
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4076-1-0x0000000000400000-0x000000000042D000-memory.dmp