d7ced0d8122688604162dcb6bf53b8d10110e5c530991d3275171fd43fa6f7fe

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe
Size 110KB
Sample260807-eael8awhnd
SHA256 d7ced0d8122688604162dcb6bf53b8d10110e5c530991d3275171fd43fa6f7fe
MD5 d0067f70ce5b99d9892dc59f16baae20
SHA1 b28fcdbfd6b9a81d6b310558767eb17191fc5ac6
SHA512 033927548a356fd59393566ec356c31823327204b77beb3913eeff081ebf1e0bca2136661ac4c66249eeff31b64ebd0105aa8b8fe54c982942b7182927abd940
SSDEEP 3072:5O248B0EMlIHxbHPwYV/wlmNie0ROfOlu:jLSzIHxMYV/9i16
TLSH
T188B38E1BFE074092F60089B0057F65F7E73B685B2B1B571BA78CDE3EA972141AC2528D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3232	winlgon.exe
4872	rgsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	4304	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4304	2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe
3232	winlgon.exe
3232	winlgon.exe
3232	winlgon.exe
3232	winlgon.exe
3232	winlgon.exe
3232	winlgon.exe
4872	rgsvr32.exe
4872	rgsvr32.exe
4872	rgsvr32.exe
4872	rgsvr32.exe
3232	winlgon.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 3232	4304	2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe	89
PID 3232 wrote to memory of 4872	3232	winlgon.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0067f70ce5b99d9892dc59f16baae20_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\rgsvr32.exe
    C:\Users\Admin\AppData\Local\Temp\rgsvr32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 648
  2⤵
  - Program crash
  PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4304 -ip 4304
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rgsvr32.exe

Path C:\Users\Admin\AppData\Local\Temp\rgsvr32.exe
Size 32KB
SHA256 1ab5d2ea45fbff4444eabb45a3a31538730ce56f2b9c041bcab958e3c69db97b
MD5 a22518e8a73ec19da806817d825d8a9c
SHA1 6f99e1591e1ce68ac44cd760729b2aeb2cba3559
SHA512 8f56ea79eab4b2e1d6b81981a9cd4f9652821b1cf17337ff3abf5796654fef08859fe4fa186015507b00ac606eefade1541235fcc6202ebf5257a1311638511e
SSDEEP 384:NMt3O0ZGwf162eGjUaXFYVf6DZX06gbg/VFrFPB1eKT6Kumg:NePZG8PUaWtl1bgdj/eKTlu7
TLSH
T11BE20926BA870C62C7A0D238136B6675D5B3BC672F27878B4744ED2D1C3B0819D3A35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 110KB
SHA256 41c80333a71079bee98043f6907dd12cc9c50103d44c7d858c36af8a9c094d61
MD5 3c902c851738e60cea80574afec2a4b3
SHA1 cc9d775898ea955769cf8ffa266e09c9840b9ae3
SHA512 0b1108329396684707dc3373490ca784760237bbd188b2d3977ef9700ea42607f4da10989fc2ead836126561aed14902f1315e28f0d5605c7ad4dbca439a0f65
SSDEEP 3072:5O248B0EMlIHxbHPwYV/wlmNie0ROfOle:jLSzIHxMYV/9i1q
TLSH
T163B38E1BFE074092F60089B0057F65F7E73B685B2B1B571BA78CDE3EA9721419C2528D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads