448a41cb9fee149736dc64bda0b60ec8f26ff0a41b7f563d68776b137c0d2aba

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe
Size 19.5MB
Sample260821-ekttwssdpc
SHA256 448a41cb9fee149736dc64bda0b60ec8f26ff0a41b7f563d68776b137c0d2aba
MD5 ba8d11f44c34e2864c515a3d4d29039b
SHA1 e621b4ef29108cb46851305ca2a44ce11eea653e
SHA512 bb8c3f35a9fb17c144ad29e9d8b030efe03cd0fe256e6e39accf0396426ee9a1d55fd96d48738f3990ee7e1378e40e1acbe3ab20faa9924b4eef16f61d5db354
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNk:jf
TLSH
T11027745388F78D3C3EB49E2DB28C4594D191ACD9D5F561378E98DE7268B3D3B6B8A000
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2924	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2924	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4172	2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe
2924	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 2924	4172	2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_ba8d11f44c34e2864c515a3d4d29039b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 472
    3⤵
    - Program crash
    PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2924 -ip 2924
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
Size 33.9MB
SHA256 4e2c390b8220a92f193464d8e8e5829e59966a5e33315666a97c66b15ef89fe9
MD5 dbc1db9756b92e949227481401269a55
SHA1 6ce3d4d1d5bad62ebc4410d43c8276639a3efe02
SHA512 ad20b2ba5dc046b5d825867f8202886b64699ca580d138d3edd087dfa72b8d20d2132c6277109a2c46ce5d835b40f3ae464abb33f8c47a3408d0f45fe40a6e08
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNf:jY
TLSH
T19177B71298B1CA7C6EED0F2AA19C20F2E04618D6D6E8D23B5E81E97570F3D6F4BCC455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download