f43ca7815786bf19d46f9ec023434113f91d4eef6766db339d3817cadf9285a9

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe
Size 31.9MB
Sample260806-ceefxa1eqe
SHA256 f43ca7815786bf19d46f9ec023434113f91d4eef6766db339d3817cadf9285a9
MD5 051f77b6d3fcbd0aaa61be4c5e7b69c9
SHA1 43e94cd40a932fa0e928ffb61c88e3042a924029
SHA512 01170acd86754a08afcf5a7044df22c69362fb7891e96c3b40b12091d479d3a7a38ac07267850cb61a74576bf48ca2340bead7ee46737039c3d7ef9ec2461034
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZP:P
TLSH
T17777A8D87261DA0AA4D4DED9B874CE2FDF10700484586E4B8FD89A97FB1E4F94878F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2620	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6104	2620	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4884	2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe
2620	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2620	4884	2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_051f77b6d3fcbd0aaa61be4c5e7b69c9_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 468
    3⤵
    - Program crash
    PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2620 -ip 2620
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 46.0MB
SHA256 6e81cc4079b6813f5ef61b2d19ed492f91aa6b6ff58b2032eda2e2e18431234d
MD5 602ab76d7b865cee3d1aad2abd93e3b9
SHA1 542cb4665f2cc000c9bdb67773b9d2263ae8b177
SHA512 99b3aff8d01263fc19a0fc16629c97b630a1703c5f29abf8b0ddb3d31bafd7f1631ea6b571424972c622b4eef39a860272e70e6a953aa2c9d6c4aeb0193d08eb
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZX:X
TLSH
T166B7C8CE6663FD0695E4A699B4398E2FF94070009418FF8F4F8C6AE7BA590FC815CE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download