f8b7828d6817d6780118cc542d10401dbe3d9af94a575c02df63997f4ef0722b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe
Size 30.7MB
Sample260522-c482tafx2s
SHA256 f8b7828d6817d6780118cc542d10401dbe3d9af94a575c02df63997f4ef0722b
MD5 325e81286d556a74ed180b5127530b05
SHA1 6393e4c7705f61267c2999ce1bfd4cab2ac13261
SHA512 24cec491d20df19ba5eaf9281b7b68b4d6673655cc2693335b83b5b28e31fdbda6d9ae15361b3dbfe01634a1ba058d6612d0c74c1b19d41c37f87529dd9de053
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/:ja
TLSH
T100671D4BC06A94638567452039C067A79ADA730CEBDFA0367B5C690ACCC5DD67C2F8CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3292	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	3292	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe
3292	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3292	1964	2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_325e81286d556a74ed180b5127530b05_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 432
    3⤵
    - Program crash
    PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3292 -ip 3292
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
Size 43.2MB
SHA256 a756e2c39ef7d50edd429b413557fcf299b90834b9b5d4a2886f652cc840afa8
MD5 3e8a8952bcf93f1cef170f9ccc49212a
SHA1 e1b2fceda1106769687ff87220cfef3f93ca5e95
SHA512 3fe1c045e109d8516bd92eab3c6288e8583756be91741c16e484e8135f3166e9aed902725697b914cd2bcc6cee20b04b05223813d4fabddcfd2b495c5c11c49c
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNe:jt
TLSH
T1F9A72A47C0E7A4558533496019C0AF73A78E770E9BDF20B66B1CAA6FDCC58A63C164CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download