d5d38c9d51244e83943e85235c41d323173a8af8c4ba3f1ef85a36576d2bff09

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
Size 27.4MB
Sample260709-xcv14agy21
SHA256 d5d38c9d51244e83943e85235c41d323173a8af8c4ba3f1ef85a36576d2bff09
MD5 f5a42841ed4533a906b1db13816f8b53
SHA1 80118f31676f0dcfb8c42021f557394eae4ad734
SHA512 68713d27a7e732468f2e2bed0ab4f91fbb124988452a31c5d3e94dacc7be5fa93aa92d5be9ceb1bb303a10cc7d20795708b0643b4287327415d4dce9850f2b2d
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNG:j7
TLSH
T1EC57B7B019AD9AC1E84BEE4C67C85FC93AD6C9B5CC8185D16C72B5178A431E3374C3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1144	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	1144	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4168	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
1144	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 1144	4168	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 424
    3⤵
    - Program crash
    PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1144 -ip 1144
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 41.2MB
SHA256 d30e7a9b6be5cf3609e8bb8e1fcbf49a7278f3c347a19fb610d4ffb3f9bc550e
MD5 c47dd9f2b86b005f13d3aa1aee507e90
SHA1 290c564b4577837223354fc43ee7a5aa4c4b2b32
SHA512 51ac810dce3c1dddf2597a19686359f353a695e19c55f0d4351267e16c3e69d6c5551ded197c5bdc23952dfe70df43c189107215671438d5ed83b6c1f700f041
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN:jm
TLSH
T1B497E9B40AAA4EC1E853EE8837489FCE379748B1D4D585D66D72A9678A0F1F373083D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download