977d4f140aa34b62ab66dd9b3da68300b8dcf358e7dda97e8ed3b0f9e8206041

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe
Size 13.6MB
Sample260701-slrmtaax8x
SHA256 977d4f140aa34b62ab66dd9b3da68300b8dcf358e7dda97e8ed3b0f9e8206041
MD5 7f56c4972b6a151e63cb5c827b542e9a
SHA1 d7a20b4984a7b24b42587cb0287329f017d7d312
SHA512 25a0ac29d9d20bef7e7a8b14b46b8e33aa7aab0205d893682d882c066b89443ff2c074e84938549fc327a5346ed116a00150430b27b395737dd46c59dd750107
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBU:EW
TLSH
T180E6127286B0A4909E93EB1BB0767E5CB0B453046CB535DB2E4E22557F5EC27E804FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6036	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
6036	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6020	2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe
6036	lsass.exe
6036	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 6036	6020	2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7f56c4972b6a151e63cb5c827b542e9a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 28.4MB
SHA256 58a33b15413666f65421f6379328842c295fb6f8b88debc32384e5a3248fe7c3
MD5 e41f26586997213c6366d7e71e281cce
SHA1 cc47a046253cc301701de7b6f03854f2d861587f
SHA512 e52f2bc0afa970153c1bdc2f43b0c4b6709bc7debbdbd8cd841a9793f93de652f24f889f021c2af6ac2f8a8afd497c0b2c515d93f00326edb02892496b408719
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBD:Ed
TLSH
T1FC6774B6CF72906089C3D937E8BF72496A38071C9CE5A5EF058841F88A5D836F584F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 64aa34427328944120c214ecd9260613949689f938aafdd7b601666992273eaf
MD5 9d1e486fdda0528a968c7d064e7b73e5
SHA1 7f4983d75cfaea0e55e82c21c205664ec76b44b2
SHA512 62900fa3f60721a7d51aa58d054a36d4d4d157a0f412f3147864548406a8e1087f22a080c239e00c75365cbf7a6a45146fe7cdae1770bcec3bc66cdcccf41232
TLSH
T13AB0124152EDCE970409940315616449D071BC085AA633484B14C70729D1489FE413A0
MD5 SHA1 SHA512 TLSH