ccec1a58222a0b269d2af411b1901cc132f7437e8c9c84f9dcdc0fe4cffc1bf4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe
Size 31.3MB
Sample260811-dvletsfj2z
SHA256 ccec1a58222a0b269d2af411b1901cc132f7437e8c9c84f9dcdc0fe4cffc1bf4
MD5 46b7c4c95cf40016debb56c194603889
SHA1 17549271f53febb702e4bde0845264edf60250ab
SHA512 3bc964e8413fc3889cb646cb00c0ae1b2aa695df4c52faf51bf368c31b93724bd736d5217583cdde11aee81a0fa8f417857af48cb4794e6db269c05b39f4483e
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZc:c
TLSH
T14477C82E597D4718D2C1021D2D8E2ABF93A078360D32996924673BB4FBADE54FC73178
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1988	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4712	1988	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3704	2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe
1988	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1988	3704	2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_46b7c4c95cf40016debb56c194603889_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 420
    3⤵
    - Program crash
    PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1988 -ip 1988
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 43.7MB
SHA256 033e0740eff36283f76bca3efdcf71fec83ce60a4e2c4dc8b45a02969906239e
MD5 479aa09cf9efa08ef289fb52929b1173
SHA1 3a3c8adf3f0deb67f7640446db43f09f9b2d8d6d
SHA512 cfc89b36c8d7d8c044b426a3055eb0d4d5f04372af4ba119de51a01f26b1c86c142626d9f51df4c41b93f0d2548447bddf8e914d24048bab63ea4e926da74775
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZP:P
TLSH
T1F8A71A2D902947009180423FAEDD32BF52E07D251E36C56824AB3FF8BA79D69F97B135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download