b7815aaef686aabb8d0678400b9d447289c68c90832d711300270746958ff47e

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe
Size 49KB
Sample260807-cc49jsem3t
SHA256 b7815aaef686aabb8d0678400b9d447289c68c90832d711300270746958ff47e
MD5 1960ce6d2854ac77681a538ca1154a1f
SHA1 c8f10dee492c81b748acbadd1d4994e85bb4278d
SHA512 55a710a3afa5fdabc4957d835eb6951a4cb5030edd2ef8efee2547ef383aa4653552a0f70a140d3fedf815de1ba09a320bf698397072ebe8a732e3076c1dc8d8
SSDEEP 384:zLMiPJznj7+1gflJ52I1r8UTEjTSgkWUKpQq6:zLPJznj7I8hrDTSTiW
TLSH
T14E336D8699C450B1DB64D172197A9E3082331EEA0A785BD76F38FE2C7C33265ED5314E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2364	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5844	2364	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4924	2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe
2364	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2364	4924	2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_1960ce6d2854ac77681a538ca1154a1f_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 472
    3⤵
    - Program crash
    PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2364 -ip 2364
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
Size 11.8MB
SHA256 536df1bcc68121e251c82b833c38301782e8b0bb45fb4c60d88398f72baf54c7
MD5 10b47f224c86a9334ca679b78999464f
SHA1 cc53d0b2d39379dbd687947087224e29340f2e02
SHA512 00ee34106e4ac4185952774aadc67a501e7b1827fd4d8168eada95089eb94062f1d6e372a9e0a4a647c2ffd4ea39c6bac6a216b04c36e0c7472bdeff46a14dc0
SSDEEP 384:zLMiPJznj7+1gflJ52I1r8UTEjTSgkWUKpQq6l:zLPJznj7I8hrDTSTiW6
TLSH
T153C6F1117833E526E108D1DE4A290A05BF05E576ABDEF424AE259BF6CC28C98F4F351F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download