65b38665fc027954350ce4c9c352ec80ca2cba082b979f357235183801c83967

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe
Size 41.9MB
Sample260723-cdkljacp5w
SHA256 65b38665fc027954350ce4c9c352ec80ca2cba082b979f357235183801c83967
MD5 2b1aaf1cf103f9ce2301091216032de5
SHA1 62b8f487afb44272a42ddd8294cdbb345ef01d6d
SHA512 74023736313727634e8b4d86244dce1de3dfe314cc45f6b1b03ed7120caae333af29892bf053e10d41bbe96adc3f4e1e220befa6efd6fe502d6ef74657728f3b
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNU:j7
TLSH
T163A7D93449EB2E05815EE227EAADB460BBBB7FA4F455E3407C37E5348EB831150E6907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1784	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	1784	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5520	2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe
1784	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 1784	5520	2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_2b1aaf1cf103f9ce2301091216032de5_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 472
    3⤵
    - Program crash
    PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1784 -ip 1784
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads