649b5db988f5c08b72fedfc37db1e71c602fb3bb30b296f450ad305a964037e3

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe
Size 2.7MB
Sample260705-ma6ppsby3y
SHA256 649b5db988f5c08b72fedfc37db1e71c602fb3bb30b296f450ad305a964037e3
MD5 5650f4e9d65c20ca6b3f99dcdf2c1d46
SHA1 88f555fb422b175d6f4fa0436050066fb6f4aee6
SHA512 713c57433962e59d0671afe01d056b550873db8950675f32f8fe4336805e527aed53237677206c204b29651eb328196b94ea3530662ebccdd42750a4ce008bcc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB:Eb
TLSH
T16ED5ACBE501FA861F4298DE10805FBB44CB089FB88981FCB622134F6EA6D5B53377756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4252	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4252	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6124	2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe
4252	lsass.exe
4252	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 4252	6124	2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_5650f4e9d65c20ca6b3f99dcdf2c1d46_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 14.6MB
SHA256 6b601cfdb5d5d76d4cd5db9567ddc0d4d791108a56942f1b5e11438c9ab5a129
MD5 9b7e5beb2e4e9b7b72f91c30332fbd05
SHA1 d98459aa870d3d13b5ab666b27bdd81e449f81e8
SHA512 c949385fe4ffa5b333d3ac0f7d3be88dad82fba5ad644716e70b696dcc4e0b8dcb0e877f2a68729c453aa7d48460a71ec6f3143b8d32e8d58bf3028b71a2edbe
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBF:Ef
TLSH
T1E3E633CCCCAEA487D8943FD4E6545CA13AB40C6F761C6DCA560BC0ACDD0CAEAB75245B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 96d7997094b441daa1db1e9e235c36e5ab86c49997bd155b04ec067812760425
MD5 145722253d1c10c04bc0be705a1a49d0
SHA1 7da3c5e10e4609bee3d51fe2992d674cbe5e25a3
SHA512 9c22df16809a7723b37b4ff51f8e57b8d6fb0c5a9ff3929528df967ced06b8dff9fbe5fbd5ef0261651d836d85f09380caf2d6aa3558c9664029f4f0f6c7632d
TLSH
T115B01211CA6A45250405505B5D725908D0D07C086E5E13589711CB4412C1F1DF945EA2
MD5 SHA1 SHA512 TLSH