81893354a7bb56a5e984e1679ad706e8aedbcb2cae6c1bafb987980f4f3bfcc8

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe
Size 28.2MB
Sample260805-dslb2scg25
SHA256 81893354a7bb56a5e984e1679ad706e8aedbcb2cae6c1bafb987980f4f3bfcc8
MD5 234a5d1f2e0092bd8eb174d286c60ff2
SHA1 5eacff49ce4334693b96133e39f16093bf395a44
SHA512 a87c8d3d5744963d7c3b48fbe2b36b9fcc27caaf002798c546762b1f9a18ee67d212e59b123fe386e7fa245a89e37e238ee75c0d9d009fa4c5557e26e1259456
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZJ:J
TLSH
T17B57A1375D0AE69ABA8A644B7E670ABA27C338056DB477709D3F502C30A1D3DECD4385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5728	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared C\lsass.exe	2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared C\lsass.exe	2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3472	5728	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1316	2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe
5728	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 5728	1316	2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_234a5d1f2e0092bd8eb174d286c60ff2_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files\Common Files\Microsoft Shared C\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 468
    3⤵
    - Program crash
    PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5728 -ip 5728
1⤵
PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared C\lsass.exe
Size 40.3MB
SHA256 d52cf9decb52fb2a17330d38f16b03dde07941d25d891bda69b0155c94ef6342
MD5 6f84c268869352bdc2b2c0fe5d26c298
SHA1 70cef659a7b16a3c3ccc06fc33dd6d9b04630fec
SHA512 848e40906b504d46820fa0f1e1b089d8be8c50a6e7f3af790c0383af6b264241af17297d5c8f7fef41e74e15df4d2ab90d078a650ae8af1bd7b7914904360b68
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+:+
TLSH
T1A19719ABBD8A9AAAEB85684FBED3093552C738004CFD7E609D3B607C3194C39DDC4165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download