8cef6391d8916d60c36a68fe9387ba488afb295eec60388dfb19099d7be6e6be

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe
Size 18.0MB
Sample260709-xe277agy6w
SHA256 8cef6391d8916d60c36a68fe9387ba488afb295eec60388dfb19099d7be6e6be
MD5 e85d8b63fe2f47dd82105a6c8b1b667f
SHA1 baaedf1455bd375d7b9d66bb762d08f00b403918
SHA512 0fe7461f98c856ded982aeb2db99c67f7355f342e78d933a0c9379b71548fd2e7bc87622bc2b5cad41ac7c915431534a6ee42c34a9cb449a000bfca43f12ed48
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBG:E8
TLSH
T1281744AFF5D316338598586B00E10392CE118D80B40339E65D8B6CBD5BC5ABDAFE59BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
612	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
612	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe
612	lsass.exe
612	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 612	2380	2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_e85d8b63fe2f47dd82105a6c8b1b667f_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 32.8MB
SHA256 33b18bdd70717ba776f5f724a688f5353901305032cb5358aa16e8e03c58a57b
MD5 e99548f0091085240dc9adce790ba4e6
SHA1 2d922ff12f70bbff41e0a846edbcc15a001962b5
SHA512 d79d4a6b86130658c39fb6d80f9a035484a759031e0ad7cd521fed5f44b6202fb94767a6c9ed8e617ea186d185826f7ff41682bea4c46d8b190291ed6527c1e7
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBW:Ew
TLSH
T12E77B9BBE1E30536C8D05E6A58E105579DEDCF407C0332D3BCDA2C7982C66B8E9916AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 736d88bda76b9ca9dfd072299ba6ca852e070850aec89b0df684515ef625bc6e
MD5 6bb8fb04c11c56d586cd56681b85d8e0
SHA1 a1e8ebe684bdaf6f0c082110e8f825986fdf9a25
SHA512 a4f99cf4a720e7a53511f0d3d243466966a86310e0d2314dc1de6635986232b8dcde7b05674c5270329867b1dc57c582b8b1f08af1daa0cdccc425e5a3289b36
TLSH
T1A5B0120080BA5D31040091174960180FF1D1AA0C5D961B646700AA5C57D054BFB441D0
MD5 SHA1 SHA512 TLSH