c2c66791c445f6fe7708f90828d0855408dcde8728e3f6a8448b35439b2fb015

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe
Size 27.9MB
Sample260629-qcewjsd18s
SHA256 c2c66791c445f6fe7708f90828d0855408dcde8728e3f6a8448b35439b2fb015
MD5 b17495ce2a704b484777296323304ea2
SHA1 7a88f2f7d426275ff6ae04c7dc6012549f137b3f
SHA512 37e7d5cdbc20ecc0e92f48da25c4527a45fbec817a9aeb1547b2b3a73d3c747792de32f8033be6d11de6649d86ad7d67ddfffff6569be7ea7fe5b63a781f4607
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBy:EQ
TLSH
T12257979FE392B1FCB16C8709566A0F89132A45C7642F714573FB8DE16B0B81D384A36E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4272	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4272	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6132	2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe
4272	lsass.exe
4272	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6132 wrote to memory of 4272	6132	2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_b17495ce2a704b484777296323304ea2_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 43.0MB
SHA256 acc094b4a7ef4ad44d78249c0cc99cf07d715778944742ff3f8e0dda1fda618d
MD5 17bf7dac4aff21e0ad2bb23bf7e88485
SHA1 8b57b19d9b667557d41f361b1ccd43b64530b072
SHA512 f13cab74af120fb3239e15d3a506cd4e06ac26cad43b7dd107a8d9aec04430b69ac45c2c334e40c940bcb25c5e5720b1e1c1ee66056bd994c1e23a3907683452
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBM:E+
TLSH
T1AAA70C9FA14692EAF1598B0E487A2D873719A2DB143F700537AFC9615B0F44A384F36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 340aee1e5f6f5e9e5d60cf8b57384c7e12acc3533d84d463154e2238742e2c12
MD5 ed97ce052b72681c9da1432850eab3ff
SHA1 112bc71d774ff37a1ca3b21c061efa69b0b02c1a
SHA512 49eda0d64955bba5fb46e644ec20364b616bef18f340287ec96c82c728224046510e44ecbd0cbc19f6fed0a53de61e20d9ae9148bc0c95b2625652a4f5657296
TLSH
T112B0120880BA86A3340660174EA10D0CE0217C883E9B130447318544A0C384FBA80545
MD5 SHA1 SHA512 TLSH