087e49e67cda953cbf5572a02f74f5ee81b5664a2a504deb3736bf9f5bc2f8f7

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe
Size 17.6MB
Sample260811-bpswlsbg23
SHA256 087e49e67cda953cbf5572a02f74f5ee81b5664a2a504deb3736bf9f5bc2f8f7
MD5 5b3ab20516dfedbc6ae7df19720f767b
SHA1 f8f36ce60b503f71155670a0b2242a82d458ef69
SHA512 c7e3e8b1853256ad0b35a49ec03b80adf2ac4e134c988497f579809a5596ba78c057956e79c072878db0c63683e67de4a9498a25f532e7a9236f655162c5c7b1
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ4:4
TLSH
T1A91779BD58197E60B04BE680CB339938B3737A4C3A954AD72D062457EDC9364623ADF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5260	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4724	5260	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5352	2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe
5260	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 5260	5352	2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5b3ab20516dfedbc6ae7df19720f767b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 468
    3⤵
    - Program crash
    PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5260 -ip 5260
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 31.5MB
SHA256 571802b1d743ae4b589627723303861f94a1618cdebe881759a1ebdeccb034c6
MD5 3d21f429060be17d121be2a5b3555f68
SHA1 289d7c7c7a7c7192c15c001e88c96efbcd641145
SHA512 35a7f814412c4c6e0fb2a93f0bf63676d32e34ad25201f1b5e42b6327bccccb0962836b038052cf2f10cdbbb8b79ae561d04db5fb52056c04a2dbbc189c7a3ce
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZP:P
TLSH
T1C477B7AE541CA7A1B0D3C7018733913977ABA7CC2AE19BD3AC059455FAF1223423DEE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download