d5f48e7caa4a4103059a3d44b3b7cc3381ca7681dba915ab06dcb5946320cf47

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
Size 78KB
Sample260806-fm311syscy
SHA256 d5f48e7caa4a4103059a3d44b3b7cc3381ca7681dba915ab06dcb5946320cf47
MD5 fe697085507c1509676209690c1ffa1a
SHA1 ffc70f6c70e216cf78275a9a0db67e7918db1e6e
SHA512 2e3d004f5195e4447361e356f6d55fba1c6fcb6bed333a293e49c7676c9f0facdade40ed6f15d77d8d3f6a139ab0f1a66ba7cc3e8a990acf56d964a849c20d4b
SSDEEP 1536:w96NXdCOKtbqsha1LViH/UWYPwYf5iI8txOMwOMQJL:y698OKBgVifvYPwYfWtxOfObL
TLSH
T1DB738C17FA068092FB0449F004BE61F7A737694A2B1F5B17779CCE2EFAB22919C2414D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4756	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	924	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
924	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
4756	winlgon.exe
4756	winlgon.exe
4756	winlgon.exe
4756	winlgon.exe
4756	winlgon.exe
4756	winlgon.exe
4756	winlgon.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4756	924	2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_fe697085507c1509676209690c1ffa1a_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 652
  2⤵
  - Program crash
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 924 -ip 924
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 78KB
SHA256 04d3aed5a943d990202146ee1b72928367d56ad0fe9b4c5baa3a1360a9054828
MD5 037a33b534bf997cbf2c260844f4228b
SHA1 9d5127532ea620ab98da3818e0e4c68bdfe72195
SHA512 32931e533b3dd1b20b869e689d90a8c2a9b88f3fef5eab1a506554cae2c443aa9c1c6100521a32c339f876e02a9b25366720f76be6287aeb1147cdcfee2f3e05
SSDEEP 1536:w96NXdCOKtbqsha1LViH/UWYPwYf5iI8txOMwOMQJ0:y698OKBgVifvYPwYfWtxOfOb0
TLSH
T14C738C17FA068092FB0449F104BE61F7A737694A2B1F5B17779CCE2EFAB22919C2414D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/924-1-0x0000000000409000-0x000000000040A000-memory.dmp

Download

memory/924-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4756-9-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4756-13-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4756-18-0x0000000000400000-0x0000000000415000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads