fed777b8797e848c773c48ac95e6ad1dfb4d27c16027b6c32235b3352f16d6c2

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe
Size 25.5MB
Sample260629-mx91msbs6w
SHA256 fed777b8797e848c773c48ac95e6ad1dfb4d27c16027b6c32235b3352f16d6c2
MD5 fbf433551c6a4f6ec49372c4be3152fc
SHA1 4c8f146f80a49eb372d01d95426e2011f418f3b3
SHA512 159662e0f6b7f78cc058ea3114251132b554a06e786ff3da36f4a733d7716fd39203345bb648d63ce18694ff0659153cc759127540c1cdc0cbae8b7ce3d472b9
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:EF
TLSH
T16C4709CAA5ED776A57B6F20A14038E710F811CCAE79D0FA95374D6E7256133B0E8243E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2216	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2216	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5436	2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe
2216	lsass.exe
2216	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 2216	5436	2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_fbf433551c6a4f6ec49372c4be3152fc_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
Size 37.7MB
SHA256 1851c1fa24cde615eec33e91fa65ec660a5e08f199f2574dfc7c3aab2c8eb5be
MD5 b8d7d5a0e5091d4c49bed8f4ecb9c0b5
SHA1 a38dea82bec5bea07010cbf0f679e708afb4a79b
SHA512 f039224f1b3df77ba2497e511b76f90c298e3de84c9ae38033067886bc8c6af49d8eb1fb5c1c6be104da6c4460e32c5d1f502159e4e07d86c5dd88e146e1c1e1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBh:EH
TLSH
T17A87F9C6D895277CA5EDA2101483AEB31EC72C95D6492F7F63B96323625336A1BC303D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 f471124e728607887ebb5de4b205c5bc48252f5130ae53dcfd66ca642b3b4ad5
MD5 fa6e5eaed5e38668e05beeff21e16c74
SHA1 08d89ce1e1ef463c33415fb55b19bcb729c538d3
SHA512 69618bc07ffa52d2e6c37955e1ca96cb83457b441673ce11e1621d488b33e3fa1f1f9465d335993e91c30f3537e18e22765d4ee2af230931b36205e571e10316
TLSH
T1D8B0121140B947232554B12B06B15D8CC010792D696B2B884740F888638048DBEB4110
MD5 SHA1 SHA512 TLSH