6ad4405202153535b5a8b6a539265bab06d3511114b39af88efcf3eab4910aae

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe
Size 12.5MB
Sample260816-zklthaxset
SHA256 6ad4405202153535b5a8b6a539265bab06d3511114b39af88efcf3eab4910aae
MD5 8e1205694f9fb4c889515a23759ac78f
SHA1 17a0ce1f955c633e0581c3a651dc6cb45dd638de
SHA512 c918dc3ed93ef8548f53247a05ba59363a5abde17cc2e18da5b79834f04a6a91722b8bde03d74df10f859e1391887d3f8c0af87858fdfb38b56bb22e679cb2e0
SSDEEP 6144:XxW6PJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJs:9o
TLSH
T159D6726675607A32B4A0DA430DCCE64CB51824C4DAA725336D3306B8DD3DDDB6A2BFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4812	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	4812	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4256	2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe
4812	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4812	4256	2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_8e1205694f9fb4c889515a23759ac78f_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 468
    3⤵
    - Program crash
    PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4812 -ip 4812
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 27.7MB
SHA256 f58eeddda28cc13242f4639525123b2baf7c987e42fc2abc63ce13b33daf9f12
MD5 6a91b44a73eccaaab682044ff8973a38
SHA1 36d7ee182d783a5bdc956acbc0b1ec88ade45dff
SHA512 71e9110784540a28bb857911dc91795621fc369fcd64014284a3d1bf624163d39e1eae19ec1d7ecc5bd8f366b7f034d590f001f63fc1867ef7f4d2611479d6da
SSDEEP 6144:XxW6PJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJz:9P
TLSH
T11E57976A218CBE726030EDD7154CEB0C78569CC59A513A77BD079AB4C4BFB470C6AE8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download