d5d38c9d51244e83943e85235c41d323173a8af8c4ba3f1ef85a36576d2bff09

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
Size 27.4MB
Sample260709-xcv14agy21
SHA256 d5d38c9d51244e83943e85235c41d323173a8af8c4ba3f1ef85a36576d2bff09
MD5 f5a42841ed4533a906b1db13816f8b53
SHA1 80118f31676f0dcfb8c42021f557394eae4ad734
SHA512 68713d27a7e732468f2e2bed0ab4f91fbb124988452a31c5d3e94dacc7be5fa93aa92d5be9ceb1bb303a10cc7d20795708b0643b4287327415d4dce9850f2b2d
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNG:j7
TLSH
T1EC57B7B019AD9AC1E84BEE4C67C85FC93AD6C9B5CC8185D16C72B5178A431E3374C3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4916	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared L\lsass.exe	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared L\lsass.exe	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4900	4916	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
4916	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4916	2632	2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f5a42841ed4533a906b1db13816f8b53_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 472
    3⤵
    - Program crash
    PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4916 -ip 4916
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
Size 40.9MB
SHA256 eaf9b5f52cd2cabb353f2392ccfaec5e8282bdd06b7f591a8bc6bdcdc2bc7ab2
MD5 65dd4c6b7bbaac0536a668ce155d9790
SHA1 1348dda21d90e001a420fd801a41c7845a8ac739
SHA512 cadaaf133797937fb69cd0dfd8f25c5f2939dfd7077284f345d947e6a0b7e98a77a0950586268ab3ef4d8e912f61c7449c3fdc5b73049bf16507d3db38400067
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNb:jC
TLSH
T15F970AA0156CA7E2E907DF9453CC57C82EDAD2F5AC9149E2BA329307C9830D7365C3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download