31eac4360824f3488775bcb94c788fdd53752d100513cf07b2fb490442668291

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe
Size 19.0MB
Sample260714-1tam9set9q
SHA256 31eac4360824f3488775bcb94c788fdd53752d100513cf07b2fb490442668291
MD5 87e01755ca9dccc125448aff175b03b1
SHA1 f3ea5dc93c4782dfeea8c7aebffa88ee5173d5be
SHA512 5d4716cad0708449a13a6a72767b12aeaf0192b1301b25edd7b2ba87721fbdd3f5a92c09a30ceaae9b8c7638fff80585efd82af70d2269c1ab967299b051fd61
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBd:ET
TLSH
T1AA1756F579642DD05B9E10FE33A40FCBB3AC14820A699CA1F9FDAF75CB08648554237A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
800	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
800	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared M\lsass.exe	2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared M\lsass.exe	2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5252	2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe
800	lsass.exe
800	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5252 wrote to memory of 800	5252	2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_87e01755ca9dccc125448aff175b03b1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
Size 32.2MB
SHA256 7d91430423768c39069210691ae83a55bf022b2115dc7aed5bc3a37d7fa2a7da
MD5 a650c08fb59acfe7bd29585d2aa55d5c
SHA1 446070efa6847df6d636151989b406d64fb6f195
SHA512 7bf5234c859d524c4e8950ace7aab313b0081e620fdb6d14da8f759365e5e01130a0b53b28a9dff5d3754d354fcb63878566be3a1b0e5b30f98ac994c9dc805c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:Ef
TLSH
T10B77B9F4759C3CA06FC410F9275147CFE1A6488B372AEE52B5F6DE368A07A0948467F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 50c21f68cb57ef5570a6521f414b7c4fc28bdec3c1a157d2a7bed6b36e4cf65e
MD5 fe34ff62ede3a344e9a732e7d94cf87f
SHA1 7a2f36d596099df709e74f935ae5a27562170c92
SHA512 60403cfe17ecce399cf978b6a75204d8f6e1c15eb6438e3d3126bae4a06432a3782032fcdd62e7b0f15f9799a89af0cecbf9538b4e9e2a745825dc498c3801a2
TLSH
T107B01200687ECA21288090B35EFA498CE0526D063E151F18A310D44416C098AF940540
MD5 SHA1 SHA512 TLSH