fe8e435e405f6382b3cbb28c2d4ae54a6d083f0f5b257e89c6e2ec1f7a73653d

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe
Size 18.6MB
Sample260701-ec3f3afx3s
SHA256 fe8e435e405f6382b3cbb28c2d4ae54a6d083f0f5b257e89c6e2ec1f7a73653d
MD5 923a9a52ba88111641db2c293ea40ecd
SHA1 30833fa682fa6d9ed6fb7a61586e018d188b3c29
SHA512 497f96208d4224e437141c0547e5e5ad97c783205bff38b3db43e62af78f73afcdc87c50e78af2d03f9c0c769608bb3b8ba5377fa6e4ac6017304537158b32fe
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNe:jx
TLSH
T11F1764227820E2531A61DFB3CAC87A475BC779B7020E4EBFF368F05DE26B5692153152
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4464	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	4464	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4672	2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe
4464	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4464	4672	2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_923a9a52ba88111641db2c293ea40ecd_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 472
    3⤵
    - Program crash
    PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4464 -ip 4464
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 30.2MB
SHA256 ad9d5e99b9c24a24c795d539d08034b678bc6df71a7579f9c7c6eee864a98432
MD5 c01e5bbe257c3ac3e18d29b068718f07
SHA1 87cdcbc4a85758654e6597e4ba9b0f6a5430a20d
SHA512 2836ffa4d35e4ce21ea029be29a2f36c25107a44916b18c6b974ef6a77648b60830a6a6ab2d82461df016a2eed54ea9c4e89a12edb224c89f3fe19f5cd0c0744
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNh:jE
TLSH
T14567CA413914931316A0CEB2CED8FBDB274B37B6412AEFBB7368E16FD5665493142283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download