6da62d162001b45fdeb92a7d6f4ccfffa31e5867a2434c3f5274885e100eed65

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
Size 28.2MB
Sample260804-2mt9rsaa24
SHA256 6da62d162001b45fdeb92a7d6f4ccfffa31e5867a2434c3f5274885e100eed65
MD5 85e3b0a5f5fd97e621c66544d8afee0b
SHA1 e0657e730f6d24c8539435ef21980d589167e4c8
SHA512 e435b803ff15e1014b001c017f3de783605995c35de433e27d068c548646e7c2f65f1b8e2e20d1a061524cb689a8c0f35a24c7241632b05229bb83685889c547
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNA:jl
TLSH
T1AD57B8A7AE071BC43854C2F7A125CFCCFDD0C7E29F6DA12B296091AC6519878D9793C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3868	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	3868	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1868	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
3868	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3868	1868	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 424
    3⤵
    - Program crash
    PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3868 -ip 3868
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 41.8MB
SHA256 32e20cc795dcbafa4fda1a4ab2713fa580f956d298630487502d7fcde3791835
MD5 47ff61915c99ec2da81526f47c7dd838
SHA1 5988164d9260b9b97d907c2a9826bac3de517a5a
SHA512 494112daa17b85ee4ca2dc08d7bd4a3d0bf482e1b9086010bb168657692e1df0e3aa8d9bc3141c8dfae72f716642157599070205f171a0ce67c618c5a737f92e
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNH:j4
TLSH
T142A7C7AB5E0715C038C8D1D37525CFDDFBE087D26F6EA12B2C1482B9A8458B59AFD348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download