e51ed62d5d79d414f2141d2e96c48780953a3cfaa41d3493ae5b3ebb1c00ab6f

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe
Size 20.7MB
Sample260801-3jce8aad98
SHA256 e51ed62d5d79d414f2141d2e96c48780953a3cfaa41d3493ae5b3ebb1c00ab6f
MD5 e55391489c9ea570e10c074f997f07bb
SHA1 364084e2167a0d434754c85ad3ef6d40adcc589e
SHA512 26d14c2d6719851798eef480bc8f85630d5c212453682325758fc55996a95a58409c20e9ac16e09536f2bfdd23c042ff3beaf7645f8d26264c91d8a449acb3f5
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNl:ju
TLSH
T1C827D5DDB326E0C3E9E42B38AA0E5E5CE1BE8E57619CC07A4B763E5759CC78C244C542
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4852	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3396	4852	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe
4852	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4852	4912	2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e55391489c9ea570e10c074f997f07bb_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 472
    3⤵
    - Program crash
    PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4852 -ip 4852
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 35.2MB
SHA256 c696733f179ce2ffca89bbf80c4fac31b810543f9b460aab56b5a96ad13783d1
MD5 0a529c37c608a0c47a6ed954bd771add
SHA1 2743bc8b11ef8e307c2cfdd78742ce852c80c631
SHA512 e5b1ea98931d734142c4dcc46d40628ebbd3f847b0b1bc76595fd0aaecb109ed9feeb82d33a14b957a8d3844c9fe864e6869c47d116f399285fde89588863b1f
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNa:jx
TLSH
T10C87D7BD2FB9D493D6F41B18BA1B1CDC71EDBAA751A6C1361172FC62228E38C3C85461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download