3cc2058db6eea5ec04c85cc6f93fa8b82dbd0905621d28e5b328656703e69416

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe
Size 33.8MB
Sample260827-rfpetsaj7v
SHA256 3cc2058db6eea5ec04c85cc6f93fa8b82dbd0905621d28e5b328656703e69416
MD5 7ed19c8101a8fb58757f96b1e3091fe0
SHA1 5572416e7fd7c394d53b315469e94cec766394fb
SHA512 d884e393b6296e560935bc8648ca0ed42a38b09e80cd161a4df5bd6e20a87099b97d0b5d3354574cc83f04796eef76b1d2622665c7966e0d2feb73c2b31700be
SSDEEP 393216:1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffy:4
TLSH
T15B77B523494F5F0F3D692A6662DFDC8814B1E52DE149A10BA94CD3F156D8DCECB28E83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4584	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	4584	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3180	2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe
4584	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4584	3180	2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_7ed19c8101a8fb58757f96b1e3091fe0_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 468
    3⤵
    - Program crash
    PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4584 -ip 4584
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 48.7MB
SHA256 32a9871536ea0dc33dee90daa0823b3fca9b58b7723fd826b255c9cc2782f852
MD5 c104fdb6e40544a1349c750dbe8ea81f
SHA1 e8ed50c0ec4ebecec1d25978bfff973ddd9abaa9
SHA512 70110fe177b79b65b7ef83c8a2238b0994bd69c1907a36d37f620e23db24df10c6e64b7e9ca4e119b494220e0ac5d6ea417d0bf8d295dd9cec85db1caddf8c40
SSDEEP 393216:1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffV:L
TLSH
T1FAB729021A5B6F193C5C3173638B9D9A85B5D13CF5509037590CC3B225EEECECB39AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download