f339c68fafd6deb8d1b3b647a4cfd8ca3381e73f3ef9877519600023cd24d604

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
Size 29.4MB
Sample261102-chfhdazva1
SHA256 f339c68fafd6deb8d1b3b647a4cfd8ca3381e73f3ef9877519600023cd24d604
MD5 fb012868e56170e7ae1f89bd20cfc939
SHA1 22d9bdb058072a9d5e44342a0b6724995e46b5f9
SHA512 0b8562990da49468be9d8dabda2502b6a9ae71b5de3a2599fe7b67d1620651a6037c4c3d5585066e70ebcf4bced4a22441b0760b9d56d33e2704135c5cc6b995
SSDEEP 49152:9KGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGE:9e
TLSH
T13267955D728030222D0B9CF2395316A19974D7B6636F8DDE2D30DF922A7071BB676A0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	2100	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
2100	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2100	4340	2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fb012868e56170e7ae1f89bd20cfc939_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 468
    3⤵
    - Program crash
    PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2100 -ip 2100
1⤵
PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
Size 41.7MB
SHA256 712f2b2dd424379b02f1dfdca9c4e2e076d78129b051665f0c54460235fb0803
MD5 6626abdd5ca72dc4972ac111f042dc2a
SHA1 aeda547a6e723053e16ad732e58466f06d587539
SHA512 4d3782e3ef31dd7de03c815b6df48a497112c4cf6d7c19e777ad05714e18f6a2e68c7c4932e44d89f2e55eddbb14e1ca0288f58a8fd12d5dc9cb9f3626d7e353
SSDEEP 49152:9KGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGa:9w
TLSH
T18CA7095E738451063D8B6CF23D0B0A704A74F3B1436F49D96A345F9A2AB0B17B978B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download