461a97962625dcf8313c4fd3732899bc40de1abf79c70f44e7d609cb8c912f63

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
Size 28.2MB
Sample260804-ptqtpsep9v
SHA256 461a97962625dcf8313c4fd3732899bc40de1abf79c70f44e7d609cb8c912f63
MD5 2d061db28f999e8afc8fdd2276584de1
SHA1 ba83e8dd1e00a8ed1f91080cc404130201b67117
SHA512 efec126aeef9494accfcd9e20ed2fa3583560b41f5b6dd3d3f8c693b1c43a36df7daac56e57aeb57c56aa7acba221ddc2aad3cd394ab5ad7aa02341ba429e391
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNK:j3
TLSH
T16B57A71CD39D5720A5AFBB0E93B9CD783E51220598C1FA91B3C61DC0B8DE03A6E36E55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4988	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4864	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
4988	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4988	4864	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 424
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4988 -ip 4988
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 42.4MB
SHA256 9f92569421bf3ad44f18079cd8c8349493d9b2b26d4c672652a345832a261d87
MD5 b73170778f9a6f7aee9a6d6a52e6c58d
SHA1 2ea45c1bf0de340843e10bdd001c9ed19432a95b
SHA512 7743aace3de92cea630e641a6c7629b82e72313bc7177237fff379de8809c243cba96b6a1f99d3454e360bbdc24c2b24e05e9e44a114e7f23eab6466466c97a2
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNx:jC
TLSH
T1D5A7F864C31DE220A55F7F9E81F5CFF435162A249891E6E277C71E98B0DC13A2932B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download