983543f3e11fbc7531df9df2407c9fae72cfb72278cd10b601eff786ded223bf

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe
Size 17.3MB
Sample260701-h97c3aa141
SHA256 983543f3e11fbc7531df9df2407c9fae72cfb72278cd10b601eff786ded223bf
MD5 d9debac0bb4e5218aa891dd4e572e9ce
SHA1 8f34a2f3dcab732b0ae03e6e73e36cbe6394a933
SHA512 6e5fd93df9ed61fc288dc328ac66a59d98a285aad2f785677643ff48496cc4814b8d134b676f050f846353eff9f316b0278d1deb0ddb9d53a0e0393ac6693ae3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:EO
TLSH
T1390758DFF3AC4B0BD8AA82F1411E587587422948A6F0B1E3DB51CFA49394C9CD9117EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1140	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1140	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1600	2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe
1140	lsass.exe
1140	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1140	1600	2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_d9debac0bb4e5218aa891dd4e572e9ce_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 31.3MB
SHA256 8caccc99fc61cff063baf5ad73cb28643412a979f508ab6c837ff6305a1b009b
MD5 227a11463c47343d09bb1b0306539bf2
SHA1 02fbbc453c8f0891bf18e81336ed25f1e38cdf84
SHA512 21c05e21487468e54b4e86cad43e1992d548b3c965f3d478bd7538db2dc6091a67d592a47466344a663d0b7bf841e61b42b136967c26770e00306beefc507b7a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBr:EB
TLSH
T1BF77EA9AF32422498CFB87F5C60F1196CB12675DE2F4B073E7875E609091D48C992AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 63881b74d02f92cdfdb3b5c188668b008874538aa79fa59d391061179dbf0281
MD5 f941c5ecb2da8598f82ead0384e03e3d
SHA1 6c96c379a81cd971ceebfc8eec23c10ca9c88a36
SHA512 0a4c58b0a135c6c95a0fe8d7e8b891bf25ba5490102be9bfce71a2040ab600663a6cc5201615a5648e65271aee9a5e9618cecd2b1206ddab28a28f4a990aa9b0
TLSH
T176B0120381BE8D222040B0B35DF49058D0D1AD051ED6531827009B0B13C084DFD50140
MD5 SHA1 SHA512 TLSH