495bfe98851bfd3f1184f8a3a5bb979017d4949188fdfd9c07c7fff2fe9197a1

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe
Size 27.9MB
Sample260702-g7thrac121
SHA256 495bfe98851bfd3f1184f8a3a5bb979017d4949188fdfd9c07c7fff2fe9197a1
MD5 41d1d1a7fa467ad193f277b1304f701b
SHA1 1bfcc63108a91a06c58aaa33331c47e179b8adb9
SHA512 36975b40d8ed84e07512a0a6450c9021a9d366e5be0fbdb4b5f0ee8e7e7e0c065d53bd3e6e33e35a9cebc03e22216ef07877d45d8a799d0f4a404346487b3646
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:EH
TLSH
T19D57B8ABCE937748F96666C7CA75408D828553CA4C2418E3ECF8ED932FBC5BDC429464
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4216	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4216	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2328	2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe
4216	lsass.exe
4216	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4216	2328	2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_41d1d1a7fa467ad193f277b1304f701b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 42.6MB
SHA256 01b9f2c8455ebdc30ec0e4713ed8becf333287b264c4911731e415d0091fe06d
MD5 0718c3e172ba6509a49d7aff41294c63
SHA1 b3a8ae0d0019edcaf95814ea78db77ac8c6de09e
SHA512 346e6a4c3d1776081f32f66b4de48c62683cb96184598af1a04475a0455a4cc2e713e50fcee12f6c51fbd563869ef2e66e5b81e1ff3ad9d7dab3a0ede1cc6c1d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:Ea
TLSH
T1F5A7C9ABADD7EA08F6AB538BD9B1504E818043650C3469DBCCB8E5D7BF3C47EC462194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 c68a56a73feffee0095f5b244bd275b00f7360932af5dc52c12909d22ddaf344
MD5 d99ae101a6e019b72cd6b1871760f4cd
SHA1 3421fa42e9b86d09dfd74371c920830b39b3f1fd
SHA512 96d10ac1dfe8960b4031640d4a8a1bee4a507acaba0bb3ab8b9d2d14a9bc5d9bb7e8829be6ccae11bc68882b48591ffb47b923f2c30805400bbc593ef69406e3
TLSH
T118B01240817E45220444A02307B5240AD471BC086D2733701700C6C45281409FD53342
MD5 SHA1 SHA512 TLSH