1e2da1fd5eebb88cf0d31d84d00b7585d07c205c0cf1fdc7a393d2985db4f0ce

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe
Size 19.4MB
Sample260909-2pp3tstvht
SHA256 1e2da1fd5eebb88cf0d31d84d00b7585d07c205c0cf1fdc7a393d2985db4f0ce
MD5 28ed50a092bb5163cbb7d512f322a80d
SHA1 a8e8de2a0066e834277f70dbd79f55434f51e038
SHA512 00089c06699fd6e2cd1ac9f7084a6bf2a9f4998f1c41c6d3bccd647953c7e878f02abea785dc46e30d5e2ed21eb51868e87bfb10cf532539d6bac16c60a741ab
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNu:jR
TLSH
T18D27563DD11884428B13CDFEAB91056D334189BA5F4FCEE13BCE764DA9B25C2C67225A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1292	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared B\lsass.exe	2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared B\lsass.exe	2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	1292	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3324	2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe
1292	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1292	3324	2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_28ed50a092bb5163cbb7d512f322a80d_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 472
    3⤵
    - Program crash
    PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1292 -ip 1292
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
Size 32.2MB
SHA256 365e176a1892245143427b02e5bec8177d8d439ff92c3447d67bc75fa1a7e120
MD5 49c795eaf0d4ab434ac046a8ace684c2
SHA1 5154fecd86aaa053a07f8bc8b13dbbf2b39e748d
SHA512 59144aff24549587f21d140bbaa0123e04738187d99224d12384168338db055df11e3ecf79e20ec77390c21cf4b0b16b52605b5c98dab2cb0d75fd4da6a2ddea
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNx:j4
TLSH
T17377C765A36882805712DEBFEF80871E27559C7ABF5ECDF0279D39899B724C1C260393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download