85ac479bbd090525b6434cd8936bb07e710d2aa3a7a98909ef0c78d20e39ac0b

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe
Size 20.2MB
Sample260730-3kh96azajb
SHA256 85ac479bbd090525b6434cd8936bb07e710d2aa3a7a98909ef0c78d20e39ac0b
MD5 692d94678fce43a2633b28f0a9c665d3
SHA1 644d61c7755af64df4a7e5cf0ebd179638caad79
SHA512 f82942367df3bdd17625e169d721c37e4580593d300ee6a9367ecbbfa98648d3d3b561e47f902eda44f3713b263d3ed1e42e0f99c695bda07ce752eaf0944642
SSDEEP 384:zLMiPJznj7+1gfSw2g2I1r8UTEjSgkWUKpQq6F25252525252525252525252525:zLPJznj7Ia2ghrDTSiWt
TLSH
T1352795D2E208583AC24E543F7B2BD6788AD9AD840506252DF6015F8DBD16B733263FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2228	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6100	2228	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2300	2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe
2228	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2228	2300	2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_692d94678fce43a2633b28f0a9c665d3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 468
    3⤵
    - Program crash
    PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2228 -ip 2228
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 32.9MB
SHA256 c1121d177e11c5b13e794586db8a245a1af46bf7a33d4776be7d9f6ea94523d5
MD5 1d309fa82314f27a2a45738904863e01
SHA1 e616d59d4904e271c280b13d7f08ba5b45ffbc65
SHA512 86e30ba8877749fcb28e6d4515ac4f4d9bdada75804c0a515799b0e99aeb823d558358ccce337ecbb30af92176147ab1cee19d33da2f1988713844a6c34ecfc6
SSDEEP 768:zLPJznj7Ia2ghrDTSiWjoooooooooooooooooooooooooooooooooooooooooooe:XxDLnOiI
TLSH
T19077B8B3A19D9939825E7537BF1DD2A4A8D66C8C140B313FF8014F1CBE056A61A22F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download