ab76915edefb48ceffea889c0e08f1e9ebb1cc0f46f29b6a0b3c86931ee2ea56

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe
Size 28.7MB
Sample260718-bld82sbv7n
SHA256 ab76915edefb48ceffea889c0e08f1e9ebb1cc0f46f29b6a0b3c86931ee2ea56
MD5 1b398c4118e221aeb51a844d6e684699
SHA1 64ed8037b41dc93357cea57a6e45cf89d8f69b55
SHA512 166732903a4af845b0b97e8e42cdba7f47b65cf5d61ab9e4513422f94a87cfb0b2fd94d47d3b5bd89b62326edee704dc3a5947a30e41d93522828e123d1c7058
SSDEEP 1536:XxDLnOiWJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJc:XxDLOil
TLSH
T1CA67B8EF6267396AC622552D1EF66C39607C3363125E3F66FC1AE497910C1E0B33249B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4112	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5828	4112	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4608	2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe
4112	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4112	4608	2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_1b398c4118e221aeb51a844d6e684699_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 468
    3⤵
    - Program crash
    PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4112 -ip 4112
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 40.1MB
SHA256 80dcda616123e88f48293ca358dc46674a6fb1386651c7958723643e5699a62f
MD5 657d4a4c3d3b6aa945aec968741a94b3
SHA1 edd6faf1c94a34e80d2d2e5d5f97da81e04603b6
SHA512 578890d803860e4719fc049c557ba05a852513067563d8a4492cf1860e8ba7e5271bb14e5a4695258312bacb9f20f3e7bfdfde2cc7a1c04896d50211818869cc
SSDEEP 1536:XxDLnOiWJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJB:XxDLOi6
TLSH
T15D97E8FA62772522F1A192791AF21C36A07C3367A12E3F57BC1775A7524C0E0F36249B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download