9e0f6e38085d2818d34ca915149f737bb4ac29ba9995c75386b313f633513ef1

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe
Size 1.1MB
Sample260628-w588rab15m
SHA256 9e0f6e38085d2818d34ca915149f737bb4ac29ba9995c75386b313f633513ef1
MD5 df08ce1bad77c6634699ba5fd4e668f4
SHA1 db6c39cead9a55dc81185c72b9711ebfc42855c3
SHA512 852b8894c931e3bcf12696adaaa51c1aed64af585782790238ca2771b272db60255a7499e1b58dd54e9d88dcaac90b8e6cd62c193a13e81f456dedd0ae8b73c0
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN:ji
TLSH
T11845D818827E52AFC4714DF1B99D6FF21D4BCB701219248FBB571B88C8A8B11983B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4424	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4788	4424	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1816	2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe
4424	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4424	1816	2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_df08ce1bad77c6634699ba5fd4e668f4_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 472
    3⤵
    - Program crash
    PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4424 -ip 4424
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 15.3MB
SHA256 4223912c71a58f442e255a2e76417c155f0db381a077bba1d3672d87df7359f0
MD5 af04f3e0ead2b6c8689d5a1ee35e48da
SHA1 fe0b0ffdc3e6a015767e864733aa95f90572d6d9
SHA512 d74cad890ffcf12555f2c5da1682e0f4e79d9504ee950b3b106a43fcce301346220e345ddc18d2d069ffc876377b1a06738736a540eb3b8023e1639dc50023d0
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNC:jB
TLSH
T137F6E3E469EFF9FFDF328A20391A3B0893ADF4145BC24D5459B640AE51032E2FDD9660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download