e8932634842d3135a50c1608eb7eb72a9e6682a890507b349e1aa8c86640ab77

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe
Size 31.3MB
Sample260818-g86vgafl51
SHA256 e8932634842d3135a50c1608eb7eb72a9e6682a890507b349e1aa8c86640ab77
MD5 ba21b7a3daf14effe7842832ce24f5e6
SHA1 9fb306abd65c51d6a7ec8cdb691ed83e8f2bdca2
SHA512 8b8c399e83e65dab3766d82da141c3cf5b11b93b26cba17d9b9bd4615d784822d48273c93eb4842e6cc5b7562b046f27e0043c6dd86b1765334084562b3fb9f3
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZX:X
TLSH
T1C177A6CE81FC931E903DD32A3537AF08426D57A4923F68D2FD20CA707A0E5695467BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4188	4768	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4820	2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe
4768	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4768	4820	2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_ba21b7a3daf14effe7842832ce24f5e6_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 468
    3⤵
    - Program crash
    PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4768 -ip 4768
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
Size 42.9MB
SHA256 085708cfa14c437dd7317b611a9fea93fa4cf220551750030be16315f45317ff
MD5 c0867a5abd2ab55d4cff43fa871eb970
SHA1 7731122d624aa42addf7b698b9b8c2a667330027
SHA512 8c0cfd1cb59cf0a0bb045f0213541bc3647e0cf1bf536f5c277d4c2b08a25e944eaca997882bd45fbd617a1ea84aa84ab10791288f3e49bfa5028fd69e222248
SSDEEP 98304:9nZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZo:o
TLSH
T1FBA7E8CEC2FA820ED02C932F75769E0D825D2B60516FB8C2FD16CA71770E16854B7BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download