76c53c312c41fc2d109770f1298f29d8b369eecc63c8867241bfc5805a3ab6d1

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe
Size 15.2MB
Sample260708-cpsfhsas7l
SHA256 76c53c312c41fc2d109770f1298f29d8b369eecc63c8867241bfc5805a3ab6d1
MD5 c7609b72137bd22d035542e61d56a44e
SHA1 649cacb8fc01daf9516d094284004f67e0c31698
SHA512 894736fa6d2f7dfca9e94f349c31dd074b995bf933a7980f4a0be83111903b23987787a6423829def1b7c687fa35e9b7738b1ee415621d327384ab928aff2c98
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:Eb
TLSH
T14FF67669D794D04FF53251DCC80D9CD80EE0F0AA67B6CD0F5288372F68B246BAAB545E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3092	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3092	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3332	2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe
3092	lsass.exe
3092	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3092	3332	2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_c7609b72137bd22d035542e61d56a44e_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 28.5MB
SHA256 0ea33809533648d46c4870fad2f02b1104cc037f1021ff7cd5ed976b9f36dea5
MD5 d5f5e82129b47b3874b23607db38afa9
SHA1 bf52d894797460882e94141a2f00bdd5cf8b684c
SHA512 0584d7d4aeb21774bb07d42d8e23a758680165e6420118646144eef49f067930ce6c126842c79db04e5137d4a189626ed469d00a98b7c38ed5aa4a14f3d57aba
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBI:Ee
TLSH
T1016709AC499390074C67874E84075C252DE5FA9860F1ED0EE9C817EB1A7E1DB9AF9C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 5e5ee53bf0eaf637992576a729c4e9438cadb13f4c2a523787e90bd51a60c2ff
MD5 6355727e8f29eb7ba8afdb2aae217b9f
SHA1 a5a46f5f87ce835c78a203e8a5b57090a249f7e7
SHA512 89a261f495e6c3525fa0d1110fd925d4bdb4fdd728fe5f34ca27c72ae53b296f6c132e7bbce2f312c73d7f61f024dc532e495feeac2bc5b67f28773aaeb99164
TLSH
T1E1B0124140FAD939184050034570818DE0B17C543AE91BE00320C55522F148AFA51740
MD5 SHA1 SHA512 TLSH