4dbc1ccceacc3bd88f80b3999191ac60d5159d4632a8535f8d3c1855a2964e06

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe
Size 25.7MB
Sample260709-mcwbragv5q
SHA256 4dbc1ccceacc3bd88f80b3999191ac60d5159d4632a8535f8d3c1855a2964e06
MD5 ad4d0f9d5991e99fba88cd5bcfe6ff49
SHA1 1c2a39e89960b351b525b0ccf349289600e798f6
SHA512 4769cc5a41bb5866c1a2de4d177e1a21fe091cb000aaea537e93011d7c68db8e826e08b16cf67d4ffcc6bd79226729813565a2e0606b4035a7f32449fb36ad53
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNP:jQ
TLSH
T16547B716D0D3C209E2DD43C4AA8BEBDD8E8DB3840F9C6345F2466D3E45B0AD946F9A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1496	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	1496	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5056	2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe
1496	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1496	5056	2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ad4d0f9d5991e99fba88cd5bcfe6ff49_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 472
    3⤵
    - Program crash
    PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1496 -ip 1496
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 40.7MB
SHA256 3d635c8d28df90c2498893a35def967830db212e8d15c5b20e2224e9659265b0
MD5 fd8f2ce946d124dcfe9eb25ef78abfc2
SHA1 b126f7163cd72719cf881cb8b477bb8acce2be50
SHA512 59200cee9d808a70cf646b716a1f6b5dc7c4716247913efaaca86969635f70610d6dc95ac721a03b83fb39db3639afc069d4ce6e6230f2f3d82af5b440ae9c58
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNc:jZ
TLSH
T1B097B709D0D36225E0E403876FCBF6BE4B4967DD8F88524AF54E7E3E4D5489C2BB8918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download