108f4799eb68c2d52b747b3b4918bb2853426efc31d2dad52093c7dfa2d7ecb5

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe
Size 18.2MB
Sample260714-e6te9agw4t
SHA256 108f4799eb68c2d52b747b3b4918bb2853426efc31d2dad52093c7dfa2d7ecb5
MD5 0ed127e55fa07563850582f23a741e14
SHA1 20b2a390b5315723450c26b923d7dc35f7492385
SHA512 21d4b12add1575cbeee956258e71e1e8e13dab1a209f92bc9ddd459693ebcd644e1bb61dbfd0f62e592cdc192c0bae668328387a04b9760de83734b3b8c0e624
SSDEEP 1536:XxD7OhvppppppppppppppppppppppppppppppppppppppppppppppppppppppppF:XxDChN
TLSH
T185175308355FBE461878707988784B7DEA6AEFD7941A828C35399817307778FFC702A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1160	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	1160	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2564	2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe
1160	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1160	2564	2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0ed127e55fa07563850582f23a741e14_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 420
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1160 -ip 1160
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 31.6MB
SHA256 27bf03715c36265ba029cd8f9e80879322a3267b93b1c39fb5e85ed6f2a959af
MD5 48ef590eff16e0381ae933a8f308772f
SHA1 7ef0b41399203572c80bb68638861f83d0b90643
SHA512 f4b19762c35350e41afe3e6728cd2a412b6dfddb47bc3ebc93fc3b6ffc0b078d81856d798e17abbab61cf982f07243607a56c36265bcf729c063c4a518bf5a5f
SSDEEP 1536:XxD7Ohvppppppppppppppppppppppppppppppppppppppppppppppppppppppppl:XxDChN
TLSH
T17F77D76F2B679F5D44A8B07D99B4172CB56B92C788EF010934F8685634F3FC9B9B0281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download