4e002fc2604acfaca43b7c14b3dfe67357acffb178029028e07e044f1996c56f

Analysis

max time kernel
150s
max time network
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
Size 17.0MB
Sample260704-2trgfsey31
SHA256 4e002fc2604acfaca43b7c14b3dfe67357acffb178029028e07e044f1996c56f
MD5 65edb8fda784cb4cfc6749607f38762a
SHA1 e185478803af7a1dea87faa04bdc2bc1d126c49d
SHA512 5dd62597f8d2611401f2adaf88a95931bf2f54bea91cd7b64fbf640ea60bec6b2b82927403d902f8475a2e172b58004949bcbfc89ecfdf19289d597f80a8bc4d
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNC:jR
TLSH
T1EE0783867DD1024DC53B9EF96D401B1C7A54E0B50E92EC22BBE4251AEB90B9E33CDC6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	1732	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5728	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
1732	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 1732	5728	2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_65edb8fda784cb4cfc6749607f38762a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 472
    3⤵
    - Program crash
    PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1732 -ip 1732
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
Size 30.9MB
SHA256 581428a5bbb6047e32246a3d8298f27e61185b7f8035376a85d59d6d2e527713
MD5 932298d4af99191527c3874f00e9c592
SHA1 387c55ec8349415a196dba813d193353999872f3
SHA512 94f0d94de514c5e4a29ad2b6661e702578743e50cf2f19b0a3735084a5bc9876f28c1e761a007bc574d01038eb3a3e6f3c283f262936ea209732b95505e6f746
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNq:j1
TLSH
T1E767E98AACD1130EC03F8AF58C844F0DAE5E50705A52DC57A9B13E35BBC479FA69E81D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download