70d1e5a258765c73b9700e4bbb7dc187015f97125768d112713c31cb53cf6332

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe
Size 1.9MB
Sample260708-e3r31say41
SHA256 70d1e5a258765c73b9700e4bbb7dc187015f97125768d112713c31cb53cf6332
MD5 82273b56590189817c25059d0b4509c4
SHA1 fabee5952369fee9910f964a04531682d1cabebc
SHA512 9192df3961d9414d40f4a8850fc79a366f8ab41538def88e4a2956a5c0bda6012cc15a1267e888d9aea815872a959c3e1757ad4f467075a62d598220b018113e
SSDEEP 768:zLPJznj7Ia2ghrDTSiWPtttttttttttttttttttttttttttttttttttttttttttA:XxDLnOiR
TLSH
T13395F11A1B7A6222D7BC303F90B8DF83017DDBFCD115E5C8A97E4996A429DD01FCA069
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6056	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	6056	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6004	2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe
6056	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 6056	6004	2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_82273b56590189817c25059d0b4509c4_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 420
    3⤵
    - Program crash
    PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6056 -ip 6056
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 13.9MB
SHA256 fdbfa5d4070cd871f110b1c2b00e30bb1552cb3d6b212294b748d96b2c1b46e9
MD5 1c5ebf60ffba12913888d7f901e731a0
SHA1 c74aeb46982e4263b56d14eb4e35c4b55698b7b6
SHA512 68197a852ed992e75f27be10e1a190a2dfcd58468d24d5809c852095f921f4a0910e6cc97e7bc190d6a582f8556f98e18d94db7935a9a75b1f9d4ab79e7f4c63
SSDEEP 768:zLPJznj7Ia2ghrDTSiWPtttttttttttttttttttttttttttttttttttttttttttS:XxDLnOiT
TLSH
T1CBE612999EC8BB19C2A13A1C0E5D376758AEDD52B00038E6E004F7E4DEDF74C92C99D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download