36cda83b58470b22f667cbdd4c2cc6e38df0620ade541844631cf164203391e5

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe
Size 15.6MB
Sample260718-bcwfzabs4k
SHA256 36cda83b58470b22f667cbdd4c2cc6e38df0620ade541844631cf164203391e5
MD5 6f7f80aa46ea2964de9964533247c0fb
SHA1 f83b6d98d0ca7f9c02dbcc66c71e3fa78830b14f
SHA512 d1a0a7466935d745a70251e90d1e399c319ef938b17d0bee386c0326d6176b1d5134ee019d1be3ec7a8c6ca45adc5ed356bf6797c7805bf13d0030ce50ec737b
SSDEEP 12288:FOCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC2:Fs
TLSH
T14BF6503260A141C07D0D64E523526C9D90B8DFDAB3DEF0442F97B2B36B72199B60A79F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5656	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	5656	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5460	2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe
5656	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 5656	5460	2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_6f7f80aa46ea2964de9964533247c0fb_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 480
    3⤵
    - Program crash
    PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5656 -ip 5656
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 30.3MB
SHA256 3bedc254a27b2cf376ab309890623c5540c0374bba608c10e23b2e2de84dc59b
MD5 6feb14f28b3906d17078a9e48861d0c6
SHA1 0121f41ae32ee4fc3c376f456a94fd548bfa0733
SHA512 25cd4204909f070df3e5cc71a6b6ea52780e0b3d6bac8e8627967161a94bb2fd4061ff335bd61b67404b72f749fcdae9d00f052ec0ebfe5cbdad3870e2750049
SSDEEP 12288:FOCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCj:Ft
TLSH
T13B67E83980B112C51E2E4CF0BA90989AD674EBDE6BD6E0030B9E6161FF3356C729DC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download