4e002fc2604acfaca43b7c14b3dfe67357acffb178029028e07e044f1996c56f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
Size 17.0MB
Sample260704-2trgfsey31
SHA256 4e002fc2604acfaca43b7c14b3dfe67357acffb178029028e07e044f1996c56f
MD5 65edb8fda784cb4cfc6749607f38762a
SHA1 e185478803af7a1dea87faa04bdc2bc1d126c49d
SHA512 5dd62597f8d2611401f2adaf88a95931bf2f54bea91cd7b64fbf640ea60bec6b2b82927403d902f8475a2e172b58004949bcbfc89ecfdf19289d597f80a8bc4d
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNC:jR
TLSH
T1EE0783867DD1024DC53B9EF96D401B1C7A54E0B50E92EC22BBE4251AEB90B9E33CDC6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	2232	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
560	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
2232	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2232	560	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 424
    3⤵
    - Program crash
    PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2232 -ip 2232
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 31.1MB
SHA256 107e68e15814559578638175c6c7e464082521aa2c1000b9d3cdba8b0c25ae6f
MD5 3ca2e7fc5d2b570dd00c2b3cd6cb92ae
SHA1 5be57bfac58e35477c2608ac52e6ec6a38e11461
SHA512 b837c2839be55c85cb7934636ad0382ee7a66ac7f70a020034903e7c372d6516dd952d8445e0cd0c7f827a5385ec7f41fe9786da3d018494c6f97bcd775f4f08
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN5:jk
TLSH
T1E867FA42F942C20CC72759FA7D515A6AA7E5D2F20CC62B259FE4270D4F50F9C2A4C8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download