faa2a4557fcbe0c96d0b64d4f4b8c4a726230982d7001d5bcbc6bf29d7249738

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe
Size 17.0MB
Sample260719-1mdrcaf14z
SHA256 faa2a4557fcbe0c96d0b64d4f4b8c4a726230982d7001d5bcbc6bf29d7249738
MD5 9f678d5a5cecc1ab456f0233332108f0
SHA1 cffd1edac952bd372aa720448a5ce33b044d8e0f
SHA512 96945228147037b674a82c356a8006a6d2c56f9cbecd36665353ceccaf3f130faa52ead985cde2a6d71c9474b20b3ac21947d6e5b14e158786003c7201508484
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6:Es
TLSH
T19407857DDD3293160B780AE01597331529AFA5F573C0EEE142AC452FB4787988B78EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3276	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3276	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5164	2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe
3276	lsass.exe
3276	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 3276	5164	2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_9f678d5a5cecc1ab456f0233332108f0_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 28.5MB
SHA256 bf4f18efc244e7add5a13d167ff5824381b766efed8e069c3b7823a6abc9d3f0
MD5 bd385ed60b8d8b480ca5059498e5f5bb
SHA1 45aa8506e377f46a58d5e2a41d4a40fc173e1701
SHA512 467ba6a053ca9339716cb8912c6d3673ba209610555f3f4e1d8fc762fcfd66be0d8b9a4a43a787357c1ded2b8a572fd92e48a8323844c6055949828738f5f335
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBZ:EL
TLSH
T17E67969D983AF22103741F942469723A716F1CA662C4BFD58A6C342FE878A5443ECF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 5946ae022811ad6e7a7329950a4f92c87b3a8d115046c6387cf8327b0d24e20c
MD5 2f715688c3a694acc28d031cc080f6c7
SHA1 7bfb583f10382f648cb96b71f57dfa69a86263c6
SHA512 09a4e69bac3a5a7d4d73004d6bdd444cf29e6e14c555d76b3bf205dead830fb89ed162c1ca7e36486f02d226f4517214f3ac92935ba2800d8600b0ef92721fb8
TLSH
T153B0120183FBC5250011510396B6118BD0E8BC053A153F441304CC0DBEC0C4FFC94285
MD5 SHA1 SHA512 TLSH