c4ed93cb89c7c1fb2bb24eda49579ebe4eb7bddb0b35a798bb907a9db048f6e6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
Size 16.2MB
Sample260804-113bvseq7y
SHA256 c4ed93cb89c7c1fb2bb24eda49579ebe4eb7bddb0b35a798bb907a9db048f6e6
MD5 e6268837dec57610a30c706504b15097
SHA1 8182b6735ddbc0d7d80f07563c02bb85f3314eaf
SHA512 0c489b664efeb3f9e14cf4963d12b86e97decaf1dfcd017ae9d62935bd2d5ebfaf918b99ab3853ac037079b0dcac2fd1bad9d054a18b1fd1b0ad8e3420ef741f
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNX:jS
TLSH
T18307537A619FD5488EFEB8DDCC8ABE4817F2C58B3248BAF18F176489553013978D62C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1440	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3832	1440	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4004	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
1440	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1440	4004	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 424
    3⤵
    - Program crash
    PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1440 -ip 1440
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 28.4MB
SHA256 01ddad15f7268e5ae2b0476c9c4ee5a891bf7dc34c7c9b015e187dca8f42d25f
MD5 67a457361e0da981e21baf263483ca18
SHA1 8fdb7e4dbc44c3698a72bd41dd5ec0ba3fd9e415
SHA512 cde13787ee6916e9e8794f47fb28232cf77891a849ea7b77d287dc8d50601eac4a4df724e51af5c1bacb8af337e1f0cdea4e8f67fd9dc0767ef4e2700a4dc598
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNK:j5
TLSH
T17167D81E569EC5448AF774EACC89DEDB27F5D85739847AC34F32A489D110238F0C27AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download