74517eef00bdea2a16bb5d7b66599e1e3e5c97171ca52660798f90df6f9f0906

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe
Size 20.2MB
Sample260708-xcap6af18s
SHA256 74517eef00bdea2a16bb5d7b66599e1e3e5c97171ca52660798f90df6f9f0906
MD5 0cc951672b02c7a49056264cb131a1dc
SHA1 0d063f3e81543096b51af2c727cdbb9f9ddb0152
SHA512 f6ee61b242309eb5900d56bf43c609694dd55cdb167f35b91cb2e9e80ec9ba488125c022510b37c0f8b52c139055515dfa7c202407760da2f453e48de96c7904
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNR:jG
TLSH
T12E27A7F2E781D04AB533EE5BE54ACB5B03E7A28750AC9E002D0B7C1438B9D15B776D92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1444	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	1444	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5824	2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe
1444	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 1444	5824	2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_0cc951672b02c7a49056264cb131a1dc_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 484
    3⤵
    - Program crash
    PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1444 -ip 1444
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
Size 35.2MB
SHA256 b9c782e5763c395cbffa64a12dc3507e37bc8ef2f55e059f10f7ad104c78c3a2
MD5 c7f7a355b39d7a02c71963aa2423cdcd
SHA1 ad7db4617a48f4441f8931db95d0b86e0035f9a9
SHA512 d88714270b2fb3d5c4874ea75524c222d4c31ae4f752c4d8505cff93407533bf1302d6e0cfe2f4010c154fabeefae92d1ebf09fdbb1f612f45ffa6c0434c57bb
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNc:jV
TLSH
T12C87C662A509B0547A63B990E04BEF5B83FFB687C37C6A084F076854ECB9D247376D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download