ef517d99b19e0c365de183e4cb24f88cee8fa27f901d160be620925c6e592471

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe
Size 17.9MB
Sample260704-awk9nsd13r
SHA256 ef517d99b19e0c365de183e4cb24f88cee8fa27f901d160be620925c6e592471
MD5 89c4be70805279f2057e21bd52c0d1f8
SHA1 c02c517066c1686f5be08e1d96f33e8e11045fe8
SHA512 3947b93f6f1117f3b170acb74543554a02a1e8a41a9fab99bd86dd8185736ce9983ed5d2123aea956303185f1f5dfc9ec183ddd3269957e8180e3ff6e9e67cbc
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNY:jx
TLSH
T1C81742BE573FC6D20CBE48B3294503DAC2E55CA66DD6D6C022827E05DF85832CD6CE96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5032	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	5032	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2688	2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe
5032	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 5032	2688	2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_89c4be70805279f2057e21bd52c0d1f8_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 472
    3⤵
    - Program crash
    PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5032 -ip 5032
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 30.6MB
SHA256 209092ae2482886bd090a99fbf8517140f0cbfd63bbdbfc7ee4d67f4b9224faf
MD5 e848767955f19e889520d367dc53a550
SHA1 e8213eb675705138948604a93e7d73da3bd5453f
SHA512 f4a08379916f52eca1f1f0039111ee0d9f20d306989964c74a66a899252e9a141db60455425883eb01f6e0ae1f9d3456725c162ed257711ac3c77f972e640bf8
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNQ:jZ
TLSH
T18C67B8BE627ED1D618AE46F1D8881BCFC3E8ADB6189841C101563EC9CB85432DDFDD4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download