e7e41402cb2c07a6a0734cfce21b97c2cf66bc3be00b92bbed799ead4fb4b8de

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe
Size 31.0MB
Sample260711-df2hhac15s
SHA256 e7e41402cb2c07a6a0734cfce21b97c2cf66bc3be00b92bbed799ead4fb4b8de
MD5 761eb970d582186ebad1dabf05d17dab
SHA1 286a3f1fdedeb4329edf5a2d0fdc270cdfa0e1ff
SHA512 88ce4dba7cb8a2d40d5b637f2cd0723d5f2f65fdac854735018b9a4ab60727875039fb945888f38a1e9b42db7eaf85b80874d37e579018490556e37acaf241e8
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBS:EY
TLSH
T16A67C7A0661BFC841DE7E73F3C8467C10EBF5151B5DE7CEA480DC0983CAB2929BA5964
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3332	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3332	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4756	2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe
3332	lsass.exe
3332	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3332	4756	2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_761eb970d582186ebad1dabf05d17dab_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 43.0MB
SHA256 68ec1c96b1f95953e696145dc78cd2c5bba4d3974f92183b99b67761bdb76107
MD5 3f00b8303ab26ac58adc691c7c616d6b
SHA1 739ecfdfe7bd6ed0382824b0c12e18feed9755b3
SHA512 7868089bacd4bf48f6781961a8d21a172cf1fb748f56cb76fb5cc1c207fe6e99201fd91621b05f43df40634559497237742080a8c1f920602bd88ede9347df3f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBs:Em
TLSH
T154A7D7B05717FD8119F2EB2F1D94E7D10DEF9120B8DEADEE780CC46438B62A15B44A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 8c4385e97bc2fb0215b5ad4676db7a152a1f1d385c6aa257e9b0fd8d14caee28
MD5 48e59371a3bb5d0cc08241669a392e1d
SHA1 1804577a511b8fa5da62746de5f6a6f9e2903812
SHA512 c059f3b20de330d225b8ae5219876f9eda67aa97aeefefc87865d249ecb0a499513c5c60b22a081516efb187e201c65edc13fe50061a8618a74aabced60d3fd8
TLSH
T177B01204917DCD321200D00715F6AA0BC0A1F9091D4713144F32C758328084AFC5C354
MD5 SHA1 SHA512 TLSH