1c627b1e3c82bf12b4a910ad03a97a574b95f9929b2df2b68eaca0cc3c9ef500

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe
Size 19.6MB
Sample260704-2stv7aey21
SHA256 1c627b1e3c82bf12b4a910ad03a97a574b95f9929b2df2b68eaca0cc3c9ef500
MD5 7ff9a04e5d0b190f3ae9a7a73738311a
SHA1 2f7837ecadd4f8c84be753395d9afb68af40a321
SHA512 c7299fd81d150def507f842a11169a14822cc9443d304f0d731b0252b6946d2f4d049d0ebbd9318696d821594bc6ab875a5b7e0061c6671da335d3c4232a7df4
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:EI
TLSH
T1F827848618E3634B8B484BF81EF44B99CD171454F534B6F682B0F6CCE2F7A9536AD860
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1360	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1360	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4748	2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe
1360	lsass.exe
1360	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1360	4748	2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_7ff9a04e5d0b190f3ae9a7a73738311a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 32.2MB
SHA256 01fcc78d6876990341eef33a1944ab834fab52c5cc6daf5e3f9268e320fe2429
MD5 7e77c6cc7f4c1f75cc9f5f2c1c0dddf5
SHA1 0502c16cd1346df802b95a164850c803ebef2a1b
SHA512 110710e88af355ab149ccdcaba28a1b72709f0d76a93302dffafd34f222e602506f77f6ae99d560e6c651197243457c7deb25b9c3ebef19d79f6b16b55894870
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:Ez
TLSH
T16A77C8B021C7124B868D4BFD1BE0576BED912C54F22871FED270949DD2EFB862A9CD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 be98d48faef8c5d59e485f406196d864872de64a730ace86c06607f742cf0ddb
MD5 a3c4afadf1bf97f355e89260b207dc12
SHA1 dc068e7414ad27b0a2cdcc3d3c6d7deeb0cb3f23
SHA512 05adfef6b51968ac556f80b668bcece42b1f2ac6df661db88c710ed4e625b82ddff238d2b6648330d38d7f2006950e62cc6732118d6446525c95e0b360fa6e60
TLSH
T12CB01210816DC532140060030EA205C8D0907D982D1B57502334CE499E8084DF6C5251
MD5 SHA1 SHA512 TLSH