019ebcadf71a7241499ebdffdce19e59f936c1b71e9801eb9e125bd679afbc2c

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe
Size 32.5MB
Sample260818-eam9csdp5s
SHA256 019ebcadf71a7241499ebdffdce19e59f936c1b71e9801eb9e125bd679afbc2c
MD5 0cf9b3086136d46214110e9a1bbc3226
SHA1 285a3b9b2e244c109316fa6a334ad03f0d2b579b
SHA512 2b4f88f69ff733678d3ec7d93800ac6e4367433841d26bd05711199782129bd182952f88cf515f4d7f2fd9e3bc2163df459b790733391fd4b9e02468aac858d1
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN3:j0
TLSH
T1E577E98BB01242D98CC325048A97AF217E7986C586FBC63F71519F6B79F2F37494428E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
268	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	268	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4156	2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe
268	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 268	4156	2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_0cf9b3086136d46214110e9a1bbc3226_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 292
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 268 -ip 268
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 47.4MB
SHA256 0ed517071f6e9be453abdb03f5bed9d11f01869376d7283a64c0f4bdc1a05d3a
MD5 e96b43945262f55f83e4fa074f9077fb
SHA1 fb76f944de77053779dc4313d3c4a865c827580e
SHA512 7594e2016b7cc8be35cbd7c4e9db882a581df6f95a9b863f06b30e1f190935a0e90370caceaf6415898e3d7bc128ed76f35e830afc98369dbf4c1db41a3dab45
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNp:j2
TLSH
T166B7F8FB700256C48DC224488BCB7B403FB5C98964FB81BB22645FA7B9E673741AC55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download