e45c5a53b1e337298ee8660b004475f6fc723e4cfaf592db827b00cd942932ad

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe
Size 15.1MB
Sample260720-melv4aew7j
SHA256 e45c5a53b1e337298ee8660b004475f6fc723e4cfaf592db827b00cd942932ad
MD5 20c3f69b4d209cf2cd1fbe23fcf111fc
SHA1 e8ead45ed1fbef053b0cd3af8256e60dfd90eb04
SHA512 18ae9155120f015ea0f2c832ec74e0525e5cee11e8b77bebd9cd556614040fb3dc3af12be9d17c6a2d4aaafff05a654d5977c651031cff145ba4a8683b87b782
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBT:EF
TLSH
T1BBF612A2AAC49701DD1F55D3879EE57620210F4A7FD319B0F9702DCCA25A8336AC5AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4912	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4912	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1444	2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe
4912	lsass.exe
4912	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4912	1444	2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_20c3f69b4d209cf2cd1fbe23fcf111fc_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 27.7MB
SHA256 7cac4851de7410763613898a0a8a701419062588c41b99c89dbf7582a7a4bd59
MD5 0a24ccad83b3337ccaade3f9556144fb
SHA1 f6c4e2277b56bfb07ef6cfa0478f76530e1b14a4
SHA512 ad0f90b156164153794b5d37e70b7944944d5aa6aedce0028c6eaf50ca92117f24047a92413f65c333069357a351da3d48b70afba6a42ff38504bc2f65d409c3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:EY
TLSH
T13557C7D193C45722ED7364A2AA9C25B534A2CF4F7AE36DB0F1711CC8D29AC771489CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 2acfd06489b80aec25ea9a8b3f418dde944d8a228c6d9d2397c953503084c1af
MD5 912e7955a229be2c8a75a0c2f81ad2b4
SHA1 50f55ab9628dee044bc86326c3491da601b89b0a
SHA512 2b8b4004052591425ceb1e984a1fbbc4b52bb3b5498155d39465445f16d1103ecf0dac8843f14e7a74662c39a146ec6767d6dc24a795f9b17639e8c18aa275a6
TLSH
T149B0122461BD451D1451B12355B1050DC2906D0C1D2533440B36AA05BBE1849B9F9170
MD5 SHA1 SHA512 TLSH