1df760f5a5f8376ace106aee1bf3472284495446c3d3db2f63d7ceb62f557b03

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
Size 22.3MB
Sample260822-pbwx1aythy
SHA256 1df760f5a5f8376ace106aee1bf3472284495446c3d3db2f63d7ceb62f557b03
MD5 7b020229c48314406952060c58807774
SHA1 309d5cf788819e6eac0c755f6251b8549e998f78
SHA512 11bb87e5e814ba5986f617f33658b06028a3867cde5a4ac971cac62a9de1f62fc00118f13e8a0639829dff19e3a3d64eb4a679a2b9a7b419990ad5315559f354
SSDEEP 1536:XxDRO6UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE3:XxDE6c
TLSH
T10D37716EBBDB53CCC81400FD4A1B362E3EF5493B81E68D4D2E5948D0944DF506EB2ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5076	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	5076	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4880	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
5076	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 5076	4880	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 420
    3⤵
    - Program crash
    PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5076 -ip 5076
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 35.9MB
SHA256 719fa307f54a5ca065ed2e5c9c3158464bc5dd9718d3137a8b3b016f937a632b
MD5 c166e99457cc74d678e4811499503030
SHA1 3e01f5cb32e7bbf8e7957237ce3240091a123cf8
SHA512 fd3a2a2fc005f64b95b87eed5617ba2fe10b3c2d5d1806d0386a283a700d719e67e0d7f6ff50d6703fa43873593debc4e1efa00b2c5d923e307e3556b37446e3
SSDEEP 1536:XxDRO6UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEN:XxDE62
TLSH
T19787A69CBBEF67CCC83016F90557331639F0A1BBA4E70C4A3ED66890555DDA00EB689E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download