04700ac8d33431ce40ecadc65baf4d190535e0135fe18c68b8e496722d213621

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe
Size 29.9MB
Sample260720-lel1esfx51
SHA256 04700ac8d33431ce40ecadc65baf4d190535e0135fe18c68b8e496722d213621
MD5 848410e17b53cc0dc5da10ac1d81ad5c
SHA1 8f8f55cda843730e7eb19f9a53dd42538842009e
SHA512 6681c124d18b9b98948f8dc416126f3ac8207dc736dac4bbc9850a02ce1ced2ef550a64317869339b4d90743d3403f0b8b229841db0a020ade3ace3c5d65ebe0
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB8:EG
TLSH
T1CE67E8BC8BCD358F607AD598437C1262CE15098AD3E270EF7454AB9389AA4CB727D41F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5964	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5964	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6072	2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe
5964	lsass.exe
5964	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 5964	6072	2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_848410e17b53cc0dc5da10ac1d81ad5c_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
Size 43.2MB
SHA256 9c519617b0509f8a23a2d7e71c636061b3372f23f21d24f081648f03eb409013
MD5 f4b7609acc6fde6d139dc63d73f9fbb8
SHA1 710f256cf994617a02202530e5ee1aeb6ae51544
SHA512 aa64956766654051515d5db284e7c8981ed65d4658427a1524e19da8cc41569e25512586a84a2f58c64c134056ee37a08c5d3afe3180acde1c338203ca400e92
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBK:Ec
TLSH
T116A73CC84A81789FD5BBD1E6937C2281DE0106DCAA77F0FEE121BB53852B845F25E41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b1ee9f150f5816a452c25516e3b3cb55f98ef4a025cd4414e8e7971b38840efb
MD5 d7d23562e41c6c58ba7b1f236422b624
SHA1 032ec8cd9e78ef3be2a07b4814c2720d49432c8a
SHA512 206f98cee3f3d336add155b83fa55201aad75a876b0de089c2875152dde41b713678d0b99ffdd20eac87aec5623d60b5b8161e0c54028cb1b7bb58368ac9aa24
TLSH
T121B0124040F955261490B0534D714088D093B90C9F952B6047109C4512C350EB690142
MD5 SHA1 SHA512 TLSH