fab199b1ffc2d6891935b8c7228b7b46f368dc7554a069b9e8922f03f42e9f47

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_3e07a4b0dd42a49bf91161950c1c834b_elex_wannacry.exe
Size 970KB
Sample261030-g2fppsbs3j
SHA256 fab199b1ffc2d6891935b8c7228b7b46f368dc7554a069b9e8922f03f42e9f47
MD5 3e07a4b0dd42a49bf91161950c1c834b
SHA1 f752c21a80c92a40be1b266cf8db3e04c3835568
SHA512 a9a4760b62bf79e52452f8c57fa9b7f052af2d8d80e1ec56fcd3511584f1f69ee5d7331aadb4b7d45d40c3a65589a88728edd1e9209125f425fbc35d67446830
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mz8kOvR3B1u6O:e9C0Xgfe2D+B1m
TLSH
T1A7252339B3036070F4194E721A5A6ED59B7630752EF17027FB009ABBAE3F1E4E87115A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	4972	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_3e07a4b0dd42a49bf91161950c1c834b_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_3e07a4b0dd42a49bf91161950c1c834b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_3e07a4b0dd42a49bf91161950c1c834b_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 396
  2⤵
  - Program crash
  PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4972 -ip 4972
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4972-1-0x0000000000400000-0x000000000042D000-memory.dmp