c4ed93cb89c7c1fb2bb24eda49579ebe4eb7bddb0b35a798bb907a9db048f6e6

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
Size 16.2MB
Sample260804-113bvseq7y
SHA256 c4ed93cb89c7c1fb2bb24eda49579ebe4eb7bddb0b35a798bb907a9db048f6e6
MD5 e6268837dec57610a30c706504b15097
SHA1 8182b6735ddbc0d7d80f07563c02bb85f3314eaf
SHA512 0c489b664efeb3f9e14cf4963d12b86e97decaf1dfcd017ae9d62935bd2d5ebfaf918b99ab3853ac037079b0dcac2fd1bad9d054a18b1fd1b0ad8e3420ef741f
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNX:jS
TLSH
T18307537A619FD5488EFEB8DDCC8ABE4817F2C58B3248BAF18F176489553013978D62C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5000	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	5000	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3592	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
5000	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 5000	3592	2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e6268837dec57610a30c706504b15097_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 472
    3⤵
    - Program crash
    PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5000 -ip 5000
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
Size 30.6MB
SHA256 b58935439d4ba9d864cf0802ed5bd458d803ce617e99d97f05b7c9e2b3cec5cf
MD5 3fc1d056a29bd7fd091e926dc8c9f9c0
SHA1 cb883c27b92d78337132af816a71271cf20011f7
SHA512 6a51031fd6ccf65d9fa46a8bbbf3b7e04de2ae89cb2b8af797366911a056f492999c8d948353f012e95c1ab659183b886c5eab811c165848c16e1fd7ef8e03a3
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNS:jB
TLSH
T1B667EA7E93CD69946AFEB3D8C94B3D00577A85BE16C0B3D1EB133D98425032DB9692C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download