22906953353a06f92fb579c8297ea46ddcde79e500670b1f3104c19320a71b54

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe
Size 82KB
Sample260910-v27ebav1dw
SHA256 22906953353a06f92fb579c8297ea46ddcde79e500670b1f3104c19320a71b54
MD5 45bff960ccddf8b66574e8232d3f080c
SHA1 1470a564f886e7b6ab798d2caf4090aa2547efcc
SHA512 26373707c0b6ba61d8f7e7bc95ed2d4e6c7eba55667a928687e3691ae34ad9f6737f7738452ab2fd744e6cc69a3b36c895c8e917595150806498fd0e675188b7
SSDEEP 1536:0eNbbLsha0pLXtdNWm2uNYhm1cSMehm1s/XZI2Wu4:0eNwDpXt7CLSMehm2/XZJ4
TLSH
T169835B13EA970CB3FA1045B205AE26B7E17BF8995B396F435790DE9E1932582CC3034E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4740	winlgon.exe
1512	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3304	4220	WerFault.exe	88
3788	4740	WerFault.exe	89
1712	1512	WerFault.exe	96
4508	4740	WerFault.exe	89
2444	1512	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4220	2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe
4740	winlgon.exe
4740	winlgon.exe
4740	winlgon.exe
4740	winlgon.exe
4740	winlgon.exe
1512	winlgon.exe
1512	winlgon.exe
1512	winlgon.exe
1512	winlgon.exe
1512	winlgon.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4740	4220	2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_45bff960ccddf8b66574e8232d3f080c_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\appdata\local\temp\winlgon.exe
  "C:\Users\Admin\appdata\local\temp\winlgon.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 740
    3⤵
    - Program crash
    PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1016
    3⤵
    - Program crash
    PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 1396
  2⤵
  - Program crash
  PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4740 -ip 4740
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4220 -ip 4220
1⤵
PID:4612

\??\c:\users\admin\appdata\local\temp\winlgon.exe
c:\users\admin\appdata\local\temp\winlgon.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 720
  2⤵
  - Program crash
  PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 956
  2⤵
  - Program crash
  PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1512 -ip 1512
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4740 -ip 4740
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1512 -ip 1512
1⤵
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 82KB
SHA256 a267f58adf6947e6992db5c62cb952a86d36a5e81cfc46cc988bbb4916d273c0
MD5 bc6a40a8013051a8cff58dcd5c127776
SHA1 6140331be9c0d9487a422f95dc1baaca2e340100
SHA512 f9a6a91668bf371f752d4331827cb13dd9b4b45022295b49a38b31d1ede632d03364f27ebd315147c95c0c8433f60aeb6c255d6e0f2e5561b6ae6884885798f8
SSDEEP 1536:0eNbbLsha0pLXtdNWm2uNYhm1cSMehm1s/XZI2Wuc:0eNwDpXt7CLSMehm2/XZJc
TLSH
T192835B13EA970CB3FA1045B205AE26B7E17BF8995B396F435790DE9E1932582CC3034E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads