91a0fd4aeff3a64ce8405d82bbfa5b99ead459b0f27369de787fb81a838cca34

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe
Size 11.3MB
Sample260720-dp9kgags91
SHA256 91a0fd4aeff3a64ce8405d82bbfa5b99ead459b0f27369de787fb81a838cca34
MD5 4d13b19aebd48f1c3077b00785596a11
SHA1 1430d6271593da7270bd7a7a0b16103b009398dd
SHA512 15a3f32080eb6b1461001faa9496e25985c26a587f9834273eecb2bf43c7dfea0a318f82553166e73788343dd2b5f79409dd708a24c1f2b9654bac01d64be68a
SSDEEP 12288:FOCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC/:FR
TLSH
T1D7C6D796642D228EDF660DF62D016C5FE8F1D1F237CAD9133930ADAFA540394531AFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4088	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	4088	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe
4088	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4088	5000	2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_4d13b19aebd48f1c3077b00785596a11_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 476
    3⤵
    - Program crash
    PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4088 -ip 4088
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 25.3MB
SHA256 c686f4c66387136b77efa9b366adaaeda80c5324881e7bff48c9c34f7cde890c
MD5 e0f26e7d8a764b27138fabaa247df968
SHA1 76ca854cb08af4311879438f4ad9d44722f833f8
SHA512 f7e189e658b6a6f8bbcf5f8b47e8b547b721c7f8672216d398a155376497fa3bab55c82ac27a39eab376d9002a0718ce0dbb9768ca29c751916ecb4cf17201b3
SSDEEP 12288:FOCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCN:FP
TLSH
T19747B7579688324F6D6993F2BD17AF1E88F360DC1AA99E4F2E059C2D521C3241391EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download