f9af104cf77c51a07ea3a30f759a67d54f9dc903a7b21241e5a4dd4bb403841c

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe
Size 20.1MB
Sample260509-2d3jsady61
SHA256 f9af104cf77c51a07ea3a30f759a67d54f9dc903a7b21241e5a4dd4bb403841c
MD5 8de79b79cb28d6581a2cd29e15ee0ef1
SHA1 ba66bd82801b7d40bdd77308c18724955a4e5d5d
SHA512 f802e924f3c494a9dd7a6c8d1034f664ae613b601e09e25fc858a6befc6d72e0e5a4abce36802ddd3e08982ee6d655c8703e108bcdf65d1d4b83ed851a6cb014
SSDEEP 384:ziBMiPJznj7+1gfpW2I1r8UTEjOgkWUKpQq6hu8u8u8u8u8u8u8u8u8u8u8u8u8F:z+PJznj7IuWhrDTSmWQ
TLSH
T1682709B354B2C753F010ADEEF4DE8E69DA5E48AD0C0414D183A59EE4E7C57EB83690E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4260	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5344	4260	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4768	2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe
4260	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4260	4768	2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_8de79b79cb28d6581a2cd29e15ee0ef1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 432
    3⤵
    - Program crash
    PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4260 -ip 4260
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
Size 32.0MB
SHA256 8cb1aadce30c22713622ee9f6d7d4b1226cab20bd428b330fd1e3a7a0345ab2f
MD5 4bfe8e5be6fdf4324b9ef3dd316bb819
SHA1 ea9d6e03eb7640c2a6656ffa3be1341b5b1dc4d7
SHA512 fd017336a709a9d731499b58446fb58a662accac4f55b2a3f5f3dc5084e249bc2873a4415a41d953bdad67e6c41743820fd0f2586884971f16dc99a947bd7a4e
SSDEEP 6144:Cx5mHccccccccccccccccccccccccccccccccccccccccccccccccccccccccccd:jv
TLSH
T10D770CB7BD518B4FE131BC8FE6DD8B98CA9958DB480014E5E3549FB1E3C06938B261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download