6d47327023318859e51506cdacee7d377367fcfa37470894b78436ebaf0a783a

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe
Size 31.4MB
Sample260703-dxm2faaz5y
SHA256 6d47327023318859e51506cdacee7d377367fcfa37470894b78436ebaf0a783a
MD5 134c74fc4f85a9d10247cdafc4b7c396
SHA1 968aa84ebb1629fd6c56908df143dfecf004b798
SHA512 7ab5b2c0fc698f3f40cf78bcb3a9baa093cb66bdc81f6860288b93e4d3b2ca2f5c9112ad44e1bdc12e47edd317354d1db662d87fa43c7e7c114d238c07e2e3ea
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:EX
TLSH
T1D877C5640A63FDF49F87AF6FAD201352F62DC02917DD13CA4AA20DAA7C05D9E053E1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4552	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4552	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared B\lsass.exe	2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared B\lsass.exe	2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5144	2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe
4552	lsass.exe
4552	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 4552	5144	2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_134c74fc4f85a9d10247cdafc4b7c396_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
Size 42.8MB
SHA256 a8349fd16389301e82347646294b2ccb4a907115cbd342d853494b01ee68a8e9
MD5 554c07d9cc03329217335d2db7391bf1
SHA1 c1ce576d13d4a10671445d9f00bb3665229a6537
SHA512 148363b46ef80d3aca9dcdfb015c93cbbbdc027496fb50aa4529662ad0902cfbe3bccef3db04e943259132d84416902260d7433832bca2b161ae4f0c06f39bf3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBO:EI
TLSH
T10DA708A419D2E9F48F83AF2A89210752E718C00917DD27DE4AA70DB6F815CCDA83F5D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 a64d37c455c9dab73842e01cf49ab7635873930c7eb7ef70bf3c57bd5df50811
MD5 541a65fcc48a0aeaa47100494f690d5c
SHA1 46834442a0dc314fc0759f8e93d4b9ea97a0d20f
SHA512 acdbc9fae73fee20634f0fa2f251cc7303ec6e1ff836bf044204e8c39517f2239fc67de318ac329cc094b55d5b22d0ead95f0ec8db03e74affa2dfd0f1f977e1
TLSH
T127B01200407D87222900E4031AB0501EC072B90C2F1B13804B01CB0452C1C0EF541182
MD5 SHA1 SHA512 TLSH