f2ef32d3fe5dd375c22138f36f8ef899521a6ee86230e7115582a49a78900f5e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
Size 24.4MB
Sample260709-ce9xtacw4x
SHA256 f2ef32d3fe5dd375c22138f36f8ef899521a6ee86230e7115582a49a78900f5e
MD5 9fc14e0f4f868b3428bd2b9cd1705f9a
SHA1 a76b4fd08561a33fc44045cb3173c23bd2307db9
SHA512 4459e58b9c57a6e9220ee2b9d5133b89f53a98468e5344f6232e1aea5b4f8a7872e855ebabb0eadf4121c42cd2a4d0378d7a08fb1ed03e24303835ac4dca5601
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBM:Eu
TLSH
T1704785CEC01D7720B927ACB37FE7E3E62545A3A186D612066F76C062B215145FB4B3B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1668	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1668	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
760	2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
1668	lsass.exe
1668	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1668	760	2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 36.8MB
SHA256 7a5ec72dc8db6cbd693b13cae83ff2b08a5db9d51ea5eb7db99bccc614564a31
MD5 4090578636d86e6c7c2d39935919280d
SHA1 3e090f2577ec6aef2f9ea9e6dbf8d444be144775
SHA512 a754f020b363abf2eaf920c1558529026ea3ba86833d679cb7407ad6b9dd74fa04bb59ce62da7a99b3506e0896ff840c8511c11a937a936e3ae703354e051ba9
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBb:EV
TLSH
T12487A7EFE40F2750352A6DF77FE3B3D2A901736047EB12052B12D026B614792E64A7B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 f75e367b75062db7196cbe03dfdb3d5a130608c3990684f47efe35a9df792200
MD5 1e81f1d656dbe1731e5b38bef7194acf
SHA1 a0bc5d38a96dbb8e76d41604674b1c99a5d29ef1
SHA512 d97881c0465a10e1800ab448b2402f68654967f546b5df82689d2f2d98b7b736728ff78788354a7dc43398d9f298a290e2ecb45c5e2136e75a979d67d8c772d2
TLSH
T179B01200426A4A1A0184A00B5660B5CCC0A27A3C1D191B101301D7669FC095AFD40251
MD5 SHA1 SHA512 TLSH