4d5a1377fe78a09d3396346f288fcd5cbd08dcf87c6678807806b301a8ed4a8c

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe
Size 10.9MB
Sample260811-d914tscc85
SHA256 4d5a1377fe78a09d3396346f288fcd5cbd08dcf87c6678807806b301a8ed4a8c
MD5 1e22da3d9182b1e1e674b257cb99adb1
SHA1 a3a63270248fa3e9741e26212d8544025135a0fd
SHA512 320f2e03849ad89cd77e75e024ce956b169d46119ed0819df57424b2fd0d428f6cede80dcd473ebe9189ef66d93d4a1b6bcd29333eab601c2d5585122432ec8a
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ7:7
TLSH
T1B3C6666DA97F12D6E8C603E68F53787FD2D31AB2993CE91C842644AD09F193BA4750C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5352	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	5352	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4720	2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe
5352	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5352	4720	2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1e22da3d9182b1e1e674b257cb99adb1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 96
    3⤵
    - Program crash
    PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5352 -ip 5352
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 24.0MB
SHA256 6a116168297a577a2a35a0256d64602e71cd5591174cc273ddc5245e5e78df98
MD5 444b572771046dd89fbab36400b8a56e
SHA1 a628011e2527ff3fde11574d22d6e0795e8447e0
SHA512 2b6ae4039da9a6d566e5dd08b707679a884ee4bbe3a81ef63187436365e14fcc5efa4c07b4665a2add27426118da9e4076caef388a9901244a92f2cf7aad02f5
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZA:A
TLSH
T1D747B52D76D721E7198B84C26FA36C3FA54713D69768B117EB0EC5BD02F011A90CA7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download