57a9a580081032c9068e70203ce776a4239be5d991cf3ed81bd74f11c3550bc9

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe
Size 19.8MB
Sample260714-dbspssez91
SHA256 57a9a580081032c9068e70203ce776a4239be5d991cf3ed81bd74f11c3550bc9
MD5 e550da78e7e0a7a157b7af58470547ac
SHA1 42aa6904c2891a75858c25d06ec1de622d6663ab
SHA512 5f049ba82c0b55f7423730371bb4a386b4f14e76b0553bb33d649354eeec54bdeb5acb76cd9c356131d3fd6fec611173d43a4df9a436b8b1181c1ca2f78d3309
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNQ:jf
TLSH
T1F12773D464825EBB44DB3C3689F623C059B3C5ED32447ADA1547F2C66C6E3A4BB20AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4752	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	4752	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4240	2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe
4752	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4752	4240	2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e550da78e7e0a7a157b7af58470547ac_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 472
    3⤵
    - Program crash
    PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4752 -ip 4752
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 32.2MB
SHA256 31928a42f50bd159f8fa1e9a0b10ad337cc899e312cf9592a379df0bc88659bb
MD5 50407db44316fa5493df1c6c132b7948
SHA1 1f2fbbc16c6d67870ae4a0debb9cea2001361365
SHA512 ff45f202b0960946637be91128704a74fefd6081e48bf8909e0edc601cb3511021a83d262add1ebe7b902e06ab63ec23d313b1840fd0145d6033ce758fe808da
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNF:jA
TLSH
T17077C7D924970D7DC4EBFD22E9EA27448926F4BE10486EFB054BB1CF48793846B609C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download