505222847f44ed4e7b3f4655fea677d971b6ad503f5983142897a594e50798fc

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe
Size 15.7MB
Sample260701-eagrksdx8l
SHA256 505222847f44ed4e7b3f4655fea677d971b6ad503f5983142897a594e50798fc
MD5 9705f2f79a799e5cbc76a73f2cae7c81
SHA1 221d30f568189e535ae3883dd2500279ef860f21
SHA512 332b881362a36d799fe8051574d8886c29b389e94e990c7610c9fc26e1536791d8106f31ad718e1ad9f84fcdfa382fb4260101b5ab9f40c31f27c1433e7269b4
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:Ep
TLSH
T1F4F6450CB810F7BF861D508A03933D5FAE9716A2EE96616082DFC29D57C740EC7A6F49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3328	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3328	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1548	2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe
3328	lsass.exe
3328	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3328	1548	2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_9705f2f79a799e5cbc76a73f2cae7c81_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 29.3MB
SHA256 d507082b567e71673813255f804baf069e4a302aa5372b573b22c8c3b1c0d14e
MD5 ca2d14ded0e5aa0cb415eb03b4323aa3
SHA1 7f031192769bd17be1f22c4c8babddaaa538fa34
SHA512 69c94e156fb6565aa1c8c032d284cd9db45d62e886f1b01a771b4d3f51f03c745914f58ab783f0711f91ac3efa69bdba334eb5ee4217ebcc60cb2939c75233d1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBV:ED
TLSH
T10867871C7942B7CFD38E90CE43522CAB5A551272FEA32130A1EF87995BD710EC6B196C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 da51dcefdaeb6b1239e39072b08f64de8b4876be9b824320027c6de867fde228
MD5 22602c4c006ebb9400ae8ac2893cd629
SHA1 c345f4a691e9753fe1fc121523c9720f50a26a09
SHA512 97dc640864442ae72d0464e82125a05ad1ed2c2f9118399b585db00f77f06d14c417ce17b80ae361b864fa362ef6b099909e4d0153d67e966fac32f17e8d04cf
TLSH
T149B01214927D57711444B213CD61464CA4302C081D9637149318A44751C05D9B584131
MD5 SHA1 SHA512 TLSH