461a97962625dcf8313c4fd3732899bc40de1abf79c70f44e7d609cb8c912f63

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
Size 28.2MB
Sample260804-ptqtpsep9v
SHA256 461a97962625dcf8313c4fd3732899bc40de1abf79c70f44e7d609cb8c912f63
MD5 2d061db28f999e8afc8fdd2276584de1
SHA1 ba83e8dd1e00a8ed1f91080cc404130201b67117
SHA512 efec126aeef9494accfcd9e20ed2fa3583560b41f5b6dd3d3f8c693b1c43a36df7daac56e57aeb57c56aa7acba221ddc2aad3cd394ab5ad7aa02341ba429e391
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNK:j3
TLSH
T16B57A71CD39D5720A5AFBB0E93B9CD783E51220598C1FA91B3C61DC0B8DE03A6E36E55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3280	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	3280	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5260	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
3280	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5260 wrote to memory of 3280	5260	2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_2d061db28f999e8afc8fdd2276584de1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 284
    3⤵
    - Program crash
    PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3280 -ip 3280
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 40.2MB
SHA256 546ec93abe218efa215a0ae0af7cd1eb5f23a2ab5831744718af16bbedf27ed6
MD5 fa3b01560f308fccaa237431bf53d64e
SHA1 7226eda0d005fea342bdae301d5aa6b497745b5c
SHA512 82d6d7b94ca6f160fd16f9fffeb30c437130bd908f01f45e40ed54b0a4db6be319a15859a14009d38fa6b356df2cace3efec561b24e766cccceef713dd0c8d27
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN2:j/
TLSH
T1CE97E858C75A5712AE6F7E09D3788C742901A21CD9C0FA51E3CA3B90B9FD039EF72A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download