a08680c1a1ded0dc8d11b9021b3e3a78e1675ee42eeef238c214ebe17ac8591a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe
Size 15.0MB
Sample260724-bcnfcsel5s
SHA256 a08680c1a1ded0dc8d11b9021b3e3a78e1675ee42eeef238c214ebe17ac8591a
MD5 286df8cdcad5b3bdab3cd7e28efb4fa4
SHA1 126c010cc1d87cc3bb5e19a040b74bae7184b773
SHA512 b3881044bef4fdcbdbaa82d3fed7d02fab914a3e9b8bb0969fc5cb7ad4b688b8dde1d0dc48ed7051d14a787a1db05c58d71fd71ed77cc45af36cfe97ebe735fb
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNg:jR
TLSH
T12AF66234F1D1E9ABE4B55BF129308A171AE03F3958BA91F826B500FF22BF354694F485
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2832	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3432	2832	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5680	2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe
2832	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 2832	5680	2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_286df8cdcad5b3bdab3cd7e28efb4fa4_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 472
    3⤵
    - Program crash
    PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2832 -ip 2832
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 29.4MB
SHA256 ef07fad0cffa87af9d85091c63b5d7669042098523074dcf5919b4760760f82d
MD5 aea796b6a89ea7f7ef6d2a292a075922
SHA1 eed0136c6ace31533a2639a35ea7e62d6a506df7
SHA512 ffe203d120a6fd5080f5465d3942717a60de131160d5ce914be6a73cc5ad74fc1adf9c2dbf802dbd5ba3add01e9937cccd8311c85f85113453924f47e950b0bc
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNe:jv
TLSH
T1B467EB253EDBF4A7E5E44FF64C20D6075DE83D7294E921E41FA608EA323E291F50B1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download