2741dcf3cf4233ac9fc1f885110e7fd6d43bcfa4567c064bf69129a4b838250d

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe
Size 75KB
Sample261102-tlz5maff35
SHA256 2741dcf3cf4233ac9fc1f885110e7fd6d43bcfa4567c064bf69129a4b838250d
MD5 84cbff0c0ae6f59cb9d018d9055961a2
SHA1 9cce4ac14a5f69c07e042d52a3daff261900da4a
SHA512 5035dc16993d13f0382135607d66067cd7274388688f67cedfb9054bc9ad2b611d206f12ad7f8d32abb514c4951800b2e055369ca76bcf26fab11c260ad4eee9
SSDEEP 1536:0bSshapMJgKJUuxm2mfJPtOgqm1s/XZmQ:Y25KJFwfJPtOgqm2/XZ5
TLSH
T1D5734B97EA6A0865EB50427054AE4A72B933FC68CF2B7E8353CCCE2D1C371929C2415F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2148	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6104	2148	WerFault.exe	87
1620	5116	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlgon.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5116	2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe
2148	winlgon.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2148	5116	2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_84cbff0c0ae6f59cb9d018d9055961a2_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 732
    3⤵
    - Program crash
    PID:6104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 568
  2⤵
  - Program crash
  PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2148 -ip 2148
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5116 -ip 5116
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 75KB
SHA256 46c94fdf3d6e5aa2f69fb93a97f2656c2303f7750e572a2ede19f2014638deb4
MD5 07409e759aea3fd3ba5754963eb27d8a
SHA1 30bcd8c2d58a8fe0785d9f423f1a809cf9c9421a
SHA512 7a05a68f7bdcc4f0d728469df89c738f9f57ae56f0a56080dacf58d8a70c0e99dc61c9d6a86c733a221f6e122bf378bb3d67688808823787d986f48b35870c8f
SSDEEP 1536:0bSshapMJgKJUuxm2mfJPtOgqm1s/XZmF:Y25KJFwfJPtOgqm2/XZw
TLSH
T11F734B97EA6A0865EB50427054AE4A72B933FC68CF2B7E8353CCDE2D1C371929C2415F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads