ccb42daca383ca31a629415cf198c8bece3405371b0078e8595399e49d3f9f51

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe
Size 13.5MB
Sample260728-e2e23aaq7x
SHA256 ccb42daca383ca31a629415cf198c8bece3405371b0078e8595399e49d3f9f51
MD5 d90cb0217d27813447d9c7ac9d42deaa
SHA1 bdb502ee5904f95de32457be4cafd04fcd988887
SHA512 47f22366545748e814a00684994e1e77f72d6d808675b077c29f7714ba329ca2b4d27c97eec4230f8afb71430a39df5cc5dd02eb2d376bc674b85e86e18d6d99
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZi:i
TLSH
T1F4E6340AA01294E8E8A1E57DA19CEF7D7DC57353CB9F841E3664C0DCF131A8A74BC9A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4672	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	4672	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe
4672	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4672	2224	2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d90cb0217d27813447d9c7ac9d42deaa_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 420
    3⤵
    - Program crash
    PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4672 -ip 4672
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 25.1MB
SHA256 9593ebf992edfb30925f56d34b0fa0266c8da35d1a12b47748de0ff3209a872c
MD5 bda5c9d93ee603f1f82b47b463a0b142
SHA1 1ddb63acc76d579f41546e957c677b8db0a55450
SHA512 5d9824d878082ef1aee293b2c1a608f43735100886c8c0c1caaef89cf98d0bb32d0ac6a73388a81eba461df42be8bb9e2a9e8f12423a8e875eb02c72e66cc535
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZl:l
TLSH
T1D347B8C4D2D27065CC56F51AB5A4DAE1BDE3935387ABA11F32B0E14CF0264AFBAF4412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download