e7720adea49d66cba861102bc4c679e47ff2cab7c7d0670d775511eba0dd5c0b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
Size 4.3MB
Sample260801-d59keada76
SHA256 e7720adea49d66cba861102bc4c679e47ff2cab7c7d0670d775511eba0dd5c0b
MD5 29907c98eb6d04b0f56728b6a57839fc
SHA1 24ed99a0884a54d480417f176e226df57b125da8
SHA512 75f6bbb7efe48c216d40322fccf5bc722f42b66c5ac0ae43c75b6657f70e4585ad9c8c8d1777c10225d23fa9e1d5cd7c3170ea3c925c71a8906052defd69e3e2
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZP:P
TLSH
T1CB26F7BA046B26C0FEC76A7DD2F3FACEE0B31064513DD27442D94657A2BA8541CBE706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1504	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	1504	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1620	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
1504	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1504	1620	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 420
    3⤵
    - Program crash
    PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1504 -ip 1504
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
Size 16.7MB
SHA256 0a3cc59b05346ec765fcc99792ddca72a945821b900462a52013eb5047ff844a
MD5 4f3d07698d0aef2efa95212166283aaf
SHA1 be338c8e3ada86ea9efff851eecc754338a1fbd0
SHA512 6679fe5d344438f432da7939480b809145f7a3112a33e88aa82052eda2cded25c5cbdbf72d84c06db69c5b59340f295836a9a9b5bc47a4634384583ccee2bec5
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZM:M
TLSH
T1F007616A9D54F1CCF106DB31E8D7B7A9F406E320593DE1A14B41E8505A4AC8E13EFB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download