514f4b125e31f9accdf96524ef55920d7a09acada40d6045c256d16cc259997c

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe
Size 27.7MB
Sample260804-18btwaer8v
SHA256 514f4b125e31f9accdf96524ef55920d7a09acada40d6045c256d16cc259997c
MD5 c75747ff9d20b3e29d02c720287b9709
SHA1 82752f15fd1cf6e97e3311ddd44c2f6a968e61fb
SHA512 fddb8f1ba34118e5db8f0d549e761fd10c1c5d7812030379612e457a0aea5d24bc0ed0a10c9dc5a6defdb6f4f023d6bdeae18bb77cd21baa6a43e82b76068fd9
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNU:j5
TLSH
T1275796150BEC2CFF43B51AA6B2C5F9F4C129A238D24102AD22A75711D9DAF3C617E4B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4576	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared E\lsass.exe	2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared E\lsass.exe	2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5860	4576	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4432	2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe
4576	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4576	4432	2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c75747ff9d20b3e29d02c720287b9709_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files\Common Files\Microsoft Shared E\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 472
    3⤵
    - Program crash
    PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4576 -ip 4576
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared E\lsass.exe
Size 42.0MB
SHA256 a12fa018d682566495000407c8f63a4d1ad361e213db4bb22b71d368c4ac1a4e
MD5 3754f14e080dd5cf1079b5b74cd48d29
SHA1 ae8cbf09fc2cd261d24705fa2ad5bd34b13fa18d
SHA512 814e55cca43aee89c8c04ac0cf8be74b4f453791885b7178ee451409a9ee3b63f514268ea4d1002ffafa866eb3ec66e7af0cf12610857ae45df00a3d08097d1d
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNG:j/
TLSH
T1DAA7F9191B8D3DFF52F516D3A2C5EAF88037E568D342029E2BD14D10D4CABA9A67E073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download