d5f48e7caa4a4103059a3d44b3b7cc3381ca7681dba915ab06dcb5946320cf47

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
Size 78KB
Sample260806-fm311syscy
SHA256 d5f48e7caa4a4103059a3d44b3b7cc3381ca7681dba915ab06dcb5946320cf47
MD5 fe697085507c1509676209690c1ffa1a
SHA1 ffc70f6c70e216cf78275a9a0db67e7918db1e6e
SHA512 2e3d004f5195e4447361e356f6d55fba1c6fcb6bed333a293e49c7676c9f0facdade40ed6f15d77d8d3f6a139ab0f1a66ba7cc3e8a990acf56d964a849c20d4b
SSDEEP 1536:w96NXdCOKtbqsha1LViH/UWYPwYf5iI8txOMwOMQJL:y698OKBgVifvYPwYfWtxOfObL
TLSH
T1DB738C17FA068092FB0449F004BE61F7A737694A2B1F5B17779CCE2EFAB22919C2414D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3548	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	4224	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4224	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
3548	winlgon.exe
3548	winlgon.exe
3548	winlgon.exe
3548	winlgon.exe
3548	winlgon.exe
3548	winlgon.exe
3548	winlgon.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3548	4224	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 572
  2⤵
  - Program crash
  PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4224 -ip 4224
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 78KB
SHA256 7c4f6203484883657fb0abe30aaafdf6198c178fc3a5a437b1ec30ccff66abc3
MD5 0f873bdd710b8ed21e63ac962f2e78ae
SHA1 0ba11d520b286afe5637145414928d82a3717d3d
SHA512 28c45d7323959af33eb54de8a2328cfcd8189b152ccc497a7c97f30db549ed87769b2ff4a7c6d0b2c227fceb986f5c45004bfdb06e315e3c5b834c4ecec55aa1
SSDEEP 1536:w96NXdCOKtbqsha1LViH/UWYPwYf5iI8txOMwOMQJ8:y698OKBgVifvYPwYfWtxOfOb8
TLSH
T193738C17FA068092FB0449F104BE61F7A737694A2B1F5B17779CCE2EFAB22919C2414D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 76KB
SHA256 b6ab9e0a0fcc3cbd2486c5604f646c551ef10d882e7cc8819b5e7b4ac1c1d827
MD5 23894fee9f2c39862fa5407d27699009
SHA1 6ae8968496b7d20e3fb336f7d7b68e7f1cc3653f
SHA512 359bb3fd4f603798e7eaf3599b384814d68de0620870a540699b9fe1fe38052ebbaebaed69b732e500d993e9a8624f56e4cae5111e0a931adb47ec8b064857af
SSDEEP 1536:w96NXdCOKtbqsha1LViH/UWYPwYf5iI8txOMwOMQJL:y698OKBgVifvYPwYfWtxOfObL
TLSH
T174737D17FB0680A2FB0449F004BE61F7B737694A2A1B5B17779CDE2EFAB21919C2414D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3548-12-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3548-19-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3548-21-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4224-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4224-1-0x0000000000409000-0x000000000040A000-memory.dmp

Download

memory/4224-14-0x0000000000400000-0x0000000000415000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads