fafcd22189490bbc4116210b59f8aaccd762410fd1fbc766cf8e8058bbb651ba

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe
Size 18.3MB
Sample260730-3mbm4asvht
SHA256 fafcd22189490bbc4116210b59f8aaccd762410fd1fbc766cf8e8058bbb651ba
MD5 4518e5ff1d7bf625d7fc090e1d02872a
SHA1 7625ab2331a7d5fdfb66ac7423f3fedee5b989e3
SHA512 0e29837edf2bcdb905f70ec92a99b0d317d63cd6f0137c332d17b5d466799e504d2deebcb0469a847db52a4f0907d454e6f40f7ee29e01d76c659a323b15f245
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZn:n
TLSH
T11F177799952616CE47C2309F66358D2E2C9C37272CB902B1BEDAF3439CB18589FF64D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5024	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	5024	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3028	2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe
5024	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5024	3028	2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4518e5ff1d7bf625d7fc090e1d02872a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 468
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5024 -ip 5024
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 30.2MB
SHA256 3d072a1b6ecb219fc9361c8e9559340fe0f800dc08fbd6f28ad435cdfda939c2
MD5 992ccef0ee7880653b64df40fcba3fbf
SHA1 14a972514d54bc10e34d16bb292bb5216998f8f1
SHA512 4efcf31afd3fd5a5c6a81ed40814cd5fa03b9919dcf18f5b29edd0a6d624e764a0e6be8169ad88165bb78f97f3fd45ee34fe6c05b01e6b7e286e3de54165dc8c
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZy:y
TLSH
T1E767D97A999309CED7CB709B25354C2E2854371319E922F0BDE5F31AE9728149FF70A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download