cf9ad3397bda7bc54768bbaf994026fe44396426ae1eb6f0fe848aad5acc5899

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe
Size 14.6MB
Sample260711-c8d28scy7w
SHA256 cf9ad3397bda7bc54768bbaf994026fe44396426ae1eb6f0fe848aad5acc5899
MD5 e08cd838328c5c7add96338e28359f61
SHA1 92feefbff7630bdb79102c693dec06b287bad56c
SHA512 be60c8e8fccca27c548179a77f1447dd9d1373d08b11df24aa3e74dd3b38f617765205a3f0f9cb0f2e9247f85753955e9d9e7735cc3a20e0353204d15f4f0774
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBF:Ef
TLSH
T10BF6879F42C92AA8DFF4D78FB333A98B16DDE41E903DC31E48577851748802DA7661E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3736	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3736	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2376	2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe
3736	lsass.exe
3736	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3736	2376	2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_e08cd838328c5c7add96338e28359f61_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 28.7MB
SHA256 f917ac72ee492d889316ea29792108870409aa09442edf120f7733c3047cf6c4
MD5 074fe12069c7f82ecfff607af4d186be
SHA1 3d8a23fc51ef1a74223d135d1dfe76b27af153f6
SHA512 17ec93662813e068983d9d15b8fed61efe17b1415d7c3687f9efe85b5a254ca0952d4c9f30831d5e2ed167b1dd3509d00fc14f88f9e4852c95cfff6ca3fd164d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB7:E1
TLSH
T11D67B7EF1685AAA0DEF0455FF231A8EF10AA7541021DA34445BBFE9224B371E97731E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 09f44cc187a82df90c56ae60b688d3b1820c14087a92cb9a4549683f74367436
MD5 8d0b452d3f23c4c423da879375578d4b
SHA1 e093c3321736f0392d67ec6bfaa33a787ed28043
SHA512 8fb672112fd20906868f3279413ad77cef2fd24757cbf9ab171d943347d8a423f941a87cc1d7a310d3889207b5641ab5a916dc4f3b23902e517ea2914d5c5aca
TLSH
T134B01200417D4D22A950500B9FB26208E0907A8F1B5923100751850936C079AB950140
MD5 SHA1 SHA512 TLSH