f339c68fafd6deb8d1b3b647a4cfd8ca3381e73f3ef9877519600023cd24d604

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
Size 29.4MB
Sample261102-chfhdazva1
SHA256 f339c68fafd6deb8d1b3b647a4cfd8ca3381e73f3ef9877519600023cd24d604
MD5 fb012868e56170e7ae1f89bd20cfc939
SHA1 22d9bdb058072a9d5e44342a0b6724995e46b5f9
SHA512 0b8562990da49468be9d8dabda2502b6a9ae71b5de3a2599fe7b67d1620651a6037c4c3d5585066e70ebcf4bced4a22441b0760b9d56d33e2704135c5cc6b995
SSDEEP 49152:9KGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGE:9e
TLSH
T13267955D728030222D0B9CF2395316A19974D7B6636F8DDE2D30DF922A7071BB676A0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3868	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3812	3868	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4876	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
3868	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3868	4876	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 220
    3⤵
    - Program crash
    PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3868 -ip 3868
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 43.9MB
SHA256 ee801876535cb33b4e99b745ff4585453b7add37596e201a5e48522489f74579
MD5 c1de3aecb14971ca6885ffae7763be83
SHA1 11991e412980af0500f476ad6e602326812503f1
SHA512 9c65684b60a11bc5e5d572ea4b88c31c7c9d45ca6a8e6ca3ecd75bebd96b43c029910b98aeb63f1facff540e0aa55ea6b50b4ebcc7ab94c0b4c1af6e24f674d4
SSDEEP 49152:9KGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGn:9Z
TLSH
T1FBA7E81E730025141E4FECF6294B65F0C438A7B8AB5E48DD6F319B9119F570BB2B6A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download