1403f2f6be1c2261e163e4330388920d7efc3ccc166f1a4f7e68a60500989ca2

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe
Size 28.8MB
Sample260703-bbv4taes3k
SHA256 1403f2f6be1c2261e163e4330388920d7efc3ccc166f1a4f7e68a60500989ca2
MD5 f09cfb07c7da9f64f02656e000c6f0b9
SHA1 0b612564479a37a1d89887d3e4ecf519292adf1b
SHA512 ccf5924769be78ebfbccc8b6481332333fc453947177f65d983535df78a811dba036a1b1b9215542630fad52e12e898182d6bc733794eadf6ffc58af5c960269
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:E7
TLSH
T16C67B8351FA41A0F1F34057366BE68DBF0BD3A149F7568E9508E2D183BB801857A8BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4092	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4652	2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe
4092	lsass.exe
4092	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4092	4652	2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_f09cfb07c7da9f64f02656e000c6f0b9_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
Size 43.0MB
SHA256 c65d96f495031ff6c80a674e935e070573a234bb0b5fd8754dfdbe0a825ef06a
MD5 9432d9c51950fe8d206d18d0281af544
SHA1 3a0ac4eb2b11a6abc73a1f4e88d3e42df19f6631
SHA512 ab5cc0484eca9ec057aba21320f7abb0cb8e44022330561dff6038764e11a0b6c47c060ef782bb5dd1b4faf05bb329c0da8f87d4e5689c5827e0a5e89a808639
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB9:Eb
TLSH
T1F1A7D72B4F650F1F5B3A54337BAE1C93F1351A18AFF168AD80566E387375018CAA4ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b72b79a78ddf9bdb0633464ede85e1b9526dafc445e0a75df17b830759d7e72f
MD5 47a61be27eb70fe1fb665601d9b4f932
SHA1 3429c3f37b5f37af0ff7a12bf699f9022570c822
SHA512 89d47822a6c55c7fd50c26d4d50fe490decd5af15373327a7cace7d089f1ca64045f64758ecdb4c3934e576a3b29d27dcb840bd4f3135d75b24172607558720d
TLSH
T1DBB01245E0FD96110740506356B05508C0BAF94F795967196700C60521F080BF488381
MD5 SHA1 SHA512 TLSH