a6968f44515eaac84e783fb6ba44451a32cd761e83a11f8e4dcf7f654cac7993

Analysis

max time kernel
148s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe
Size 15.5MB
Sample260714-bl4tpsd17t
SHA256 a6968f44515eaac84e783fb6ba44451a32cd761e83a11f8e4dcf7f654cac7993
MD5 6f5aa62847a4a9770958cfdb69560298
SHA1 4cc478f3e81d1b5ff0ac1b24af18ef3ac13b85bd
SHA512 9cd372d9dd446d92573b84bda8093d1ca16c9a6a806bb3ab9c58a8ec61439c730c3986b459a9484aa4b34ace916631d34d3e8db09bab2ef1f1ac802f26c79db3
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNQ:jb
TLSH
T1B7F652224CCCDEA8E6BD9BF0346A5CCDCCD18E6059724DA2469C2286CF527BB37D52D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5540	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4172	5540	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe
5540	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 5540	2036	2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_6f5aa62847a4a9770958cfdb69560298_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 472
    3⤵
    - Program crash
    PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5540 -ip 5540
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 29.5MB
SHA256 6d940543b1be4bf98945d58b358246cac9777a4679cb02e1908f756c2d0cf5a2
MD5 f5fcb01b6bb31b769b835a90ba68fe0a
SHA1 52c99b5e25ebb6db8dd65426e8406c21bcd02e4b
SHA512 4d3e04b5e7027c440ee8e9a93b37728434bf8f64547b396c994f129e4d1f5e56a7ffe1e7d7cd7f44c28e52833a56ac271d43c24b28928d42e835b922e6932b11
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNM:jX
TLSH
T1C067A5336DDCCDE097EFA2B468464CEDC862CA243926CD6359BE31CA4E75A7677C0190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download