f3d0ef4f19baeb765bd24a11e59202bb8e0a0897ba996a0ba38bfeec8bd03eb6

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe
Size 22.3MB
Sample260815-ed42aadf96
SHA256 f3d0ef4f19baeb765bd24a11e59202bb8e0a0897ba996a0ba38bfeec8bd03eb6
MD5 5f32614e2a92775ed6176864cb3f38b2
SHA1 e8df995ba0a928118c756a0e4ae9807b5100215c
SHA512 279f2e2f005d0b9394619330b79a4189761b1456b191c60c5e02cdf30bd4796c4afde6a5d9e530ed74e256c7b691bc8ef8d9ee5ac562d7881b98b8fda2212b5d
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNz:jS
TLSH
T1E437E8B09396C10C9790D16C41667AEFA36B4BF151D8C468E269B8FCF64F7E8122C7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2032	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5960	2032	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5148	2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe
2032	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 2032	5148	2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_5f32614e2a92775ed6176864cb3f38b2_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 472
    3⤵
    - Program crash
    PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2032 -ip 2032
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 37.3MB
SHA256 dcfd714c250ae8ee0337259e9baba01a81cccc219eecd5334cc5a74748754875
MD5 49bcaf0a3985e50202d252e95c44f9bf
SHA1 7cd177e56af8e3cecc0f68a15d5756b0a2ef7fcc
SHA512 c47078aa09c7d8442cb2c1aa6eff467251c515fd408eea0292b40a82995c2304f568949e9e81fb3ace300dcb1c4b511de9d777294cb5b8c0c3b3fcd2dfa51031
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNc:jt
TLSH
T11987E87062C2630CB7E1F15401A23B87B533AABA51EE896C931659BCEB136FB53DC1C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download