d97a026be5110efeb610fa1ee330a78cd6e46fbd8ef12a77e3303b72b84cf3e6

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe
Size 17.5MB
Sample260711-dnf7jads6v
SHA256 d97a026be5110efeb610fa1ee330a78cd6e46fbd8ef12a77e3303b72b84cf3e6
MD5 2ffa71f1d2d7cf4087680ddac9a05af3
SHA1 c1363206dc892fdfa9d0fa41039f8dcc5f3a98b6
SHA512 5f954b2c752bd43729a81f1bcac0edbb9da1f31cafa79c18a53452ade25fef0240f4236afe35f3b79f6b038bb490c87e1739a6f06a4d9ebde3ab4a203bc98bf5
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:EZ
TLSH
T10C0764B0CF3825DB9A23D57D69063EB6256649629CEF683AB150FCD29F3415F000CAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4400	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4400	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
424	2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe
4400	lsass.exe
4400	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 4400	424	2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_2ffa71f1d2d7cf4087680ddac9a05af3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 31.3MB
SHA256 23eb0dcd9e848d53932a3db22889fcf678116f590deead1c103fea73cba3ead9
MD5 69a04255bdc8cccba07718ebd9054508
SHA1 22504e7aa4a389f9d95b70e44eeab4042e30d735
SHA512 a767ccebf49fce3cd0761baf6017d8a9271c94f69f7947dda09491fca060da11499b34512a97a45ed5212ccad67d247debf6769158d40ce63c69ce7c4a37d64c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBK:E0
TLSH
T17777B6708F3818EB6D22E8BEF0097B77150B4661ACC9B5787295FED49F6005E4E0DAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 0a04961d18cb46d27a5510a7bae461eea1e91cc657252028956000e647f48c9d
MD5 1697558beed2e7dc5e6f7370ece846cc
SHA1 15ffa628558967a47ec69829fbaffc73bde5af3d
SHA512 243ef01f7d870b26006930723ed32b3d2e420025610a2cbd4003a1ce5e80c92f0adbf39ca82a46f5296249a9ed968ed596bb37d32d159a30a961672515b8ae42
TLSH
T12FB0120C527A4D27400461135BF3470CC0527C0F696A238417209A04578250DBDCB522
MD5 SHA1 SHA512 TLSH