15ba30726b80fb3cb456d9e9d43efc99b42c54e0d6c7dfb4c16fe264e80e41dd

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe
Size 24.1MB
Sample260723-2spapsyckf
SHA256 15ba30726b80fb3cb456d9e9d43efc99b42c54e0d6c7dfb4c16fe264e80e41dd
MD5 02ec54853102222bed77d3f9f943ac05
SHA1 778e58758c1f0f78cbdbb1cf8246c2f94d2d7aef
SHA512 f39747ed92b9018631ebf8aa82d59ca413ee0a1800891394d165ade9353b3517e84e9ec89f419e4d42a2094f87aa28e859599c6309d3964796a403cf4b507625
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:EX
TLSH
T15C4778F8B08AC160B15874876D8072B4C3BEF7F9A9785B56F11CA455DC82ED10E8EF62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6048	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
6048	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4460	2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe
6048	lsass.exe
6048	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 6048	4460	2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_02ec54853102222bed77d3f9f943ac05_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 36.3MB
SHA256 bb6cac16ac69a55d500e62b0bb6e3f42087bdf3e1ff2f16ba53ecb0d8385c9b9
MD5 2cf159ed85f292b521d0530a6ec63ab4
SHA1 7b46e53b35e48b15019413e5580510847d1c09b6
SHA512 22d746077025ed58317db79279722f18295b3b3f1de9704781704042bdebf3938a35d1109aff51af393236db42eb2175c9ed152624366feebcd91808e114f759
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBD:El
TLSH
T11B870BF8759BC460B144E49F5C5370BDC3BEA5A7BD34A61AF028A560DE52EE00C8DBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 bb9f8c42676748a7242f8b62d9d9d9babea59f739f5c5775fa374978264f976a
MD5 4e0fd1e2c7c8f914b44ed75b63d46a9e
SHA1 19b713de4b399d68d9b24a3bf703175ec1ec3794
SHA512 2be194392a1dc1d75b56fc5e463dc8c5ecc4c423e8ef56cdee77bea50e89934561c822ac1be51314e219c46d049cd0d79185f52bc63c9b74eb3e39026c2ca977
TLSH
T1ECB0124082BF8D32010870BB6AF00B4CC3A37C186A8F271083008645698346BBDE4100
MD5 SHA1 SHA512 TLSH