b2a37b686972206cc6b78308199be92f7629d18050065cd22cdbb84a9fbbc6bd

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe
Size 42.6MB
Sample260703-c3d52sfs4m
SHA256 b2a37b686972206cc6b78308199be92f7629d18050065cd22cdbb84a9fbbc6bd
MD5 c62486e1da7b861b42148a32840f00fe
SHA1 351ec228f3937fb0c89332de6449eff62b359839
SHA512 5f67978877b5d015f4039eaeed9cdab5aa0dbaefd575d9e26173aaa0a85272df97c39671c3f872c34e5646d47c5def7b7177fee7bdffc4398b9d0afaae90fbdf
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBV:Ej
TLSH
T108A7873C44D3EDBAE626EECB07C50B605781E3C2431984B6072B623C1EF562DB655EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2012	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1464	2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe
2012	lsass.exe
2012	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2012	1464	2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_c62486e1da7b861b42148a32840f00fe_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 5f613670d4910caab6c9a01ca9fde707ade60e54a7a5bd799be4b0a2bda61f3a
MD5 514a0e6e695b56d0617df97c0425b3a5
SHA1 73dfe7c44110b210466a7eae97243ab5cf65e43f
SHA512 066b8446e4e7c11bea0a8c6d6012c3b9c36c5eb390ddd0cbb5ce9cf1d8f244d8c27c3418582321e246459d59fc4846a42b11a96ead8a0c01881f6bc558713e57
TLSH
T118B0120A42AE4722104490276BB04449C892A9046EA637404700ED4527C05DDF485281
MD5 SHA1 SHA512 TLSH

Submit Download