1322687c64cb6e168253cb5fa2ccb74b440782bc76ad042620c4c83c3cc559d4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe
Size 29.6MB
Sample260714-e5lc9aet2k
SHA256 1322687c64cb6e168253cb5fa2ccb74b440782bc76ad042620c4c83c3cc559d4
MD5 1276f26305a7bfdea0c6589dc262eb6b
SHA1 4c06bb65d936f1f89a1ee6b0f3c67d4974306eab
SHA512 38e72fe764764ff464cd4897c3015a98f41b7255ab7c41d4335cceec5afdb671112de0277e52e68f03cae813e3b339ab9211582958f6086301584ad17e3eec35
SSDEEP 1536:XxD7OhXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO2:XxDCh+
TLSH
T1B467D801A71C89F3C7F62F5A411786CB93316A4CB5B17B2A2421CE9CB4B7FB25AE4534
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1808	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	1808	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3288	2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe
1808	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1808	3288	2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_1276f26305a7bfdea0c6589dc262eb6b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 420
    3⤵
    - Program crash
    PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1808 -ip 1808
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
Size 44.1MB
SHA256 fe2f7c30c1217ccc92de7ac07dd25de03e6891d1e14c6945f2456a4d14b1a9de
MD5 7a532768cb83fd139cc2efa625e87f08
SHA1 b482bb272c3620a83a739b4e08a53d156c09e537
SHA512 c8f3f327697a3724730db200a5043545007487615cd51e45ba0fcd54bfddfabe9a8f97bad4e995845f19772ba32d55f1419443a8ccb171b5c0e1d23ea2fe3a28
SSDEEP 1536:XxD7OhXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOH:XxDCh/
TLSH
T11CA7DB09726CC4A3C7F22F6B440E87DB53712E89B136F71910269B6D7166D63ABF4238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download