6da62d162001b45fdeb92a7d6f4ccfffa31e5867a2434c3f5274885e100eed65

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
Size 28.2MB
Sample260804-2mt9rsaa24
SHA256 6da62d162001b45fdeb92a7d6f4ccfffa31e5867a2434c3f5274885e100eed65
MD5 85e3b0a5f5fd97e621c66544d8afee0b
SHA1 e0657e730f6d24c8539435ef21980d589167e4c8
SHA512 e435b803ff15e1014b001c017f3de783605995c35de433e27d068c548646e7c2f65f1b8e2e20d1a061524cb689a8c0f35a24c7241632b05229bb83685889c547
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNA:jl
TLSH
T1AD57B8A7AE071BC43854C2F7A125CFCCFDD0C7E29F6DA12B296091AC6519878D9793C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3520	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4320	3520	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
3520	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3520	4912	2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_85e3b0a5f5fd97e621c66544d8afee0b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 472
    3⤵
    - Program crash
    PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3520 -ip 3520
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 41.8MB
SHA256 e943c2ad89e82c1948f06d762e98ca2eee3b46838cd1eeb185f40f0f6265df6b
MD5 c540ef1e2046d3431d21322ecdd185ae
SHA1 d9e76e9975d0934b12e90934881093b81864d97a
SHA512 bd02538bbd6dd02babf64f7a1a71e0f16e650545a7e7ce6e7d9429f059736cb5be0bbcfcbefa3c0d4b5635bf2d43ae8a2f025be5622e875eb9c4eb906a6a0384
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNj:jq
TLSH
T189A7D6BB9A47BBD53C98D2F730198FCCB8F083D6EE1B55075A5042AE682C875A2353C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download