1df760f5a5f8376ace106aee1bf3472284495446c3d3db2f63d7ceb62f557b03

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
Size 22.3MB
Sample260822-pbwx1aythy
SHA256 1df760f5a5f8376ace106aee1bf3472284495446c3d3db2f63d7ceb62f557b03
MD5 7b020229c48314406952060c58807774
SHA1 309d5cf788819e6eac0c755f6251b8549e998f78
SHA512 11bb87e5e814ba5986f617f33658b06028a3867cde5a4ac971cac62a9de1f62fc00118f13e8a0639829dff19e3a3d64eb4a679a2b9a7b419990ad5315559f354
SSDEEP 1536:XxDRO6UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE3:XxDE6c
TLSH
T10D37716EBBDB53CCC81400FD4A1B362E3EF5493B81E68D4D2E5948D0944DF506EB2ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5716	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	5716	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4904	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
5716	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5716	4904	2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b020229c48314406952060c58807774_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 468
    3⤵
    - Program crash
    PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5716 -ip 5716
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
Size 35.3MB
SHA256 e0ce8e1ded3a0a939e7c0dcf8c121b3e97cc28e51a49211ddac3718e11e10673
MD5 6319731cbe4dbdad28f9d8607fc8d554
SHA1 167d59cda796083260b723e83f769dba77696394
SHA512 c944de5f262e2b7b730d8338cbbb5e4716f2847620b056159a08d355ff099ee3233116ece272cd8f8a6394e4950dc0f913c93479c73af52e395789b3d01652dc
SSDEEP 1536:XxDRO6UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEW:XxDE6P
TLSH
T11787B521FA8E42ECC43826ED47AF355E3EEA493B81D3CE5A195A0491968DEF01C705DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download