e7720adea49d66cba861102bc4c679e47ff2cab7c7d0670d775511eba0dd5c0b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
Size 4.3MB
Sample260801-d59keada76
SHA256 e7720adea49d66cba861102bc4c679e47ff2cab7c7d0670d775511eba0dd5c0b
MD5 29907c98eb6d04b0f56728b6a57839fc
SHA1 24ed99a0884a54d480417f176e226df57b125da8
SHA512 75f6bbb7efe48c216d40322fccf5bc722f42b66c5ac0ae43c75b6657f70e4585ad9c8c8d1777c10225d23fa9e1d5cd7c3170ea3c925c71a8906052defd69e3e2
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZP:P
TLSH
T1CB26F7BA046B26C0FEC76A7DD2F3FACEE0B31064513DD27442D94657A2BA8541CBE706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1268	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4228	1268	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4516	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
1268	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1268	4516	2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_29907c98eb6d04b0f56728b6a57839fc_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 476
    3⤵
    - Program crash
    PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1268 -ip 1268
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 16.2MB
SHA256 5c5aeb757fcc30810bc5656c8025090430e8835de17ed759ffa041c4b667a89d
MD5 5684aa4279927ebb5aeec341f025fe84
SHA1 23129ea99fd04cf82639313f2d918b72def33a24
SHA512 dda3422b9f41a63902b05cae2e81eea5674cfc7dd0d031ad880fc5867f36a5ad3b3260f133837d8c05cb4d2a7bff793c5c9ed770d915921052bee3479a631e6e
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZi:i
TLSH
T1C807559B55A71D62250FD101AB2D676B4063C45F27EEC87E121BE283FA03F5137B4EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download