cc0bbe7e3f99cee458216b0b90ff4cc23cd4e73ef6e108b5e7d67f484d097090

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe
Size 75KB
Sample260913-nyxblsyshs
SHA256 cc0bbe7e3f99cee458216b0b90ff4cc23cd4e73ef6e108b5e7d67f484d097090
MD5 a60453bca89eab3f5428ebf5c30cfd65
SHA1 9f4a7204c0f3e4602c27ba418b6f78b80d8c461c
SHA512 f236a2990b3f430a7c9d348a35f87179130fd6038d934eb7500fc50550b546a852f6c3287dcf3d7fa94c0049ed89d92dfabaab3534ce958063c2335ef6baec6d
SSDEEP 1536:0bSshapMJgKJUuxm2mfJPtOgqm1s/XZmC:Y25KJFwfJPtOgqm2/XZr
TLSH
T166735B97DA6A0865EB50427014AE4A72B933FC69CF1BBE8353CCCE2D5C371969C2416F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4316	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5140	4316	WerFault.exe	90
4652	4192	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4192	2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe
4316	winlgon.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4316	4192	2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_a60453bca89eab3f5428ebf5c30cfd65_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 708
    3⤵
    - Program crash
    PID:5140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 656
  2⤵
  - Program crash
  PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4316 -ip 4316
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4192 -ip 4192
1⤵
PID:2056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 75KB
SHA256 66140afeae3ccf1bbb4b90ff888272685de42d3c3f937280662d14e44f3dd8b1
MD5 86c613295e75974dc6240f62beb0847b
SHA1 bc13e7be42b4ca85ac6eb09343daab3987cf199f
SHA512 8794b9d8e12b324c7d6c864ff251fe0b3dd1a98415c1f429cf474e99e5ceb4868e53dae170a45f5052f7054a8bf7efdc49e3d9f404f7918abc80281ce37164e6
SSDEEP 1536:0bSshapMJgKJUuxm2mfJPtOgqm1s/XZmd:Y25KJFwfJPtOgqm2/XZg
TLSH
T171735B97DA6A0865EB50427014AE4A72B933FC69CF1B7E8353CCCE2D5C371969C2416F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads