421cb15dfc59958a9eabffeee73afb746764851fecd66a51c42f3eb88185b1a7

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe
Size 29.0MB
Sample260728-e61jkafa32
SHA256 421cb15dfc59958a9eabffeee73afb746764851fecd66a51c42f3eb88185b1a7
MD5 a4b86110fad35f80946b08cfcb033448
SHA1 31d5636c3feb67379aed270e2d0d67f5613ded97
SHA512 efe91774817fa6a759d0afcab10c22a11da3aa3442b7a628095d23e6286105d0f06c1961756ba6f37b4d268c170c9703ef832a55c86e66d2aecb6c62958651ee
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZb:b
TLSH
T19E67B7AEAD573EDFE86CFB6837B4F90757BB2E8A0E3567950074434601A48A711E3C21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	2100	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2900	2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe
2100	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2100	2900	2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_a4b86110fad35f80946b08cfcb033448_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 468
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2100 -ip 2100
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 43.2MB
SHA256 42cf5d07c15dd0e0b88100e0f6e66cfa33a931c80175394b16bb877954943920
MD5 63e5bdaf21b62fe89efccb64693650fd
SHA1 410ad9a1cc165c29f37dc6d0e65246a7ea8e58bf
SHA512 f6a16d3c5201a5d127d7956d6f0716fd80843f727efd4772639b7bf567db83e04016ae5e1ce5623ddd7c2bfbeb2b64d322e39bb0f1fe4fceb50ae22e562e46c0
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ4:4
TLSH
T190A71CFBB963699FDC2DE7F72630F50B972B1A0F5FB5937600A2425615A086130FAC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download