e9a2dce057dcaa4d4a26d728f964b5f362eab724bc2486e28d53ac35b8798285

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe
Size 18.3MB
Sample260706-3y44sadx21
SHA256 e9a2dce057dcaa4d4a26d728f964b5f362eab724bc2486e28d53ac35b8798285
MD5 f46038e72a20d35e1243a7508a913ec6
SHA1 2181b0a64901f458d2bfca09321f69b86d471813
SHA512 f08314bb83a87e038d7e8113d46fe048399b61a1af3c77deaf41c0471671241ec708c3ca0d07546e504026fc59938a72a206927c956deabd6e3a9f41de5e476a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBy:E8
TLSH
T1D917C76C9BD80A7018316B5509A9A24F54F3EFF5182BD76264B87735A030DEAF7C7B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3340	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3340	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2992	2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe
3340	lsass.exe
3340	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3340	2992	2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f46038e72a20d35e1243a7508a913ec6_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 29.8MB
SHA256 04efe91d5526c8134d13724a6dd11971d7dca02836cfaf9d7f19725707f787da
MD5 23d7b7305da0fee8288dd995550a4347
SHA1 f2f6afa752455d60d7cbb87fe17fb3e9fe6d96cb
SHA512 169ea3cc05b2d1e123f7e17cf1f4503dc0b7d68e5e3e8154f3083dc66e85f9e8104842f8c0d7b32d3b6009d0a13f961ec76584a99078a7e6cb3234766f08a174
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBE:EW
TLSH
T16667C74C6BE00EB704AD2F5E40EFA7CE85E26EF42D27F69600E8675A7075D8A73C5250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 70937db78056829dcda34150f1bf5ddb6b5b3cfd415990e3b270873a1f54b680
MD5 63999a2bd02bbf3c128a04c8a094a941
SHA1 02513c93faad12463fb9a31c6e583b84b6c3cf14
SHA512 a88e5bd8750ddf8ddfe08a1a9970d0306e08543788c21f7cd46ff4c961b76034b09700c18f134f92fea9c970b2d19842939999b7a52bd3e26ae0d53fd0b546a7
TLSH
T1E0B01200406E67121208511326B0C84DCC70ED18BB6713180758D649168244EFD41281
MD5 SHA1 SHA512 TLSH