fe71133d494357f6f57664bcf0bc2da0228ce0b3e28a3a6d42384700a9a0765f

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe
Size 29.7MB
Sample260629-p2efmsfv2r
SHA256 fe71133d494357f6f57664bcf0bc2da0228ce0b3e28a3a6d42384700a9a0765f
MD5 baff4e9285b079d3c837332a5b9f1b07
SHA1 361e651f129feef47dc0ef0ac095ad11309e80b4
SHA512 944a4e3b7dcd10e7ddd0d5684a44a36925db43290ad491e2496da5dbeb550f2a0f09d11d3077abc1c038a7412a1f5d082a0e41b5f0579df6b60871a1f5f96004
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBd:EH
TLSH
T1906795506257044783C0DA3CDF68E58BDAE66B40427A3E2007BEF441BE7926F5E66B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5972	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5972	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3084	2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe
5972	lsass.exe
5972	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 5972	3084	2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_baff4e9285b079d3c837332a5b9f1b07_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
Size 44.6MB
SHA256 fd427bb54276f6c4e613668703002690232b1be73b5eebe37e96d8c09c3754eb
MD5 3656f5cc3d3a5e4d1ce959d489a0193b
SHA1 6dbaa9835cfa6ab7db2d21f178f600c4f9f3a01a
SHA512 ab35eb1841c0181398497a9f93e5c36b5ec9b7fbf532196e38f45b5fd7b5b45d50f83c41a92c742f74e00161b98e7099a8a63c4b49f50ef3b2c7324cd90065fd
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:Ex
TLSH
T1CAA7B6903B5604536780E73CAFA5F287EBD13A85467A3A201B2FF04179BB05F4B66367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 6cfa11b4969365c5155d9a62920cd002289788cf87eb65b5441d77a2bed5a57d
MD5 89d5f547b7b851992921f548ef1c56d1
SHA1 5ce0fe38113c80ddfdd1132de44ab158460a496f
SHA512 1a72ce545b0d116018894d1fb3aae4fba0eed79de2dc7706b9666dcdefb9414a226d2b173bcad9e916e765bc6d7f57418173ba9751dad45f32c00a0bab9ab680
TLSH
T13EB01218C8FD8A57B88460074570580DF050B904596B13548704AA65328244DBEC4A04
MD5 SHA1 SHA512 TLSH