b4c890d26ffe4a940882859df4e0e14bce1b746bd490170974ea3c04e066f35e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe
Size 4.2MB
Sample260709-mah9eaht31
SHA256 b4c890d26ffe4a940882859df4e0e14bce1b746bd490170974ea3c04e066f35e
MD5 bf55b8bdb939388037f3a5e0f2e3fc30
SHA1 ec97d056a236d06601b466b4f648a91034978d6a
SHA512 8aa979d06bf3cca31892d5eba04474d92e76f737d3b980d13bd7f27e6e941d441acea6b82f5d96565facb2da9d79370e7b5a21f36dc9cdde16e7c39b0cfaa814
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNT:jk
TLSH
T1C926677DFB024D4FCC05DCFE63205706C22DAE97DF9AA89C61638E711972D069AF8906
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	2192	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5284	2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe
2192	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 2192	5284	2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_bf55b8bdb939388037f3a5e0f2e3fc30_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 472
    3⤵
    - Program crash
    PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2192 -ip 2192
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 16.9MB
SHA256 e3f266b54ae23ead3d1764cce4cdb90ccb75622d16156f5c4cb24be32f21625d
MD5 21170e6043f5829153e2ec9501e3a0d3
SHA1 02bce27ff1be63488a587f6c2dd1ae37fe4d7891
SHA512 2cad181a3c2e6a8395e250ec252cd870d4fef51a08263c4f76046ade658b3f20b1e4df5e83919d97cbab9ee05159a6670a1cd1da0743dedad5c7cf6aed66cedb
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN3:jM
TLSH
T1320753B3AD048C193EB6AC995E4D6B54803EFBC16D67B95606304E1493B38CB40E7F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download