85a84a8cffc823273ff845697581b44f1adef13cb5c993e81490322b748e86d9

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe
Size 32.1MB
Sample260703-dfnxeafv7p
SHA256 85a84a8cffc823273ff845697581b44f1adef13cb5c993e81490322b748e86d9
MD5 6d684070e6032e3805676bc3bed67d89
SHA1 f74e9e756a8cf48ca7b220ede291d5e67eea6912
SHA512 0bee24bf60db858d4fca1e633529a0b83965fdcb82ea7ed9b05d340ad49904e71db8b6b0a7e19dab50eba5c61424ead9f632a200d301b7df9589aac60f7ddf3c
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN6:jV
TLSH
T18077A65DD9DAB3CE315B3EDD21A39F9CA21F8AE51A2810F98D530FD891F107E90D9A10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5288	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared C\lsass.exe	2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared C\lsass.exe	2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3308	5288	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe
5288	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 5288	1600	2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_6d684070e6032e3805676bc3bed67d89_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files\Common Files\Microsoft Shared C\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 472
    3⤵
    - Program crash
    PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5288 -ip 5288
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared C\lsass.exe
Size 45.3MB
SHA256 b54182f5302b83963bbc56c68cba5770ce9cae29ff698a2867c670938e676dc8
MD5 c0fb8e4f74b3a7a9d8b52612a4afbd21
SHA1 9add0be511953c25c0c69f1cd4f9ceb2a6ee3d7b
SHA512 cd6ac891d627fce54ea99f91bcfec815269b766f853df3cd924b0a9fb0308efcc03194d1798a4b28751cf4c3f335761a1c72ff65d92e73191d8f5a7cfd7b9e67
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNi:jl
TLSH
T17BA7D82CE58EB3CD31993EA522B25A0CE10D8BD5653930F98D070FD4D1B507EE9EEA25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download