b71918d3630b0b889247228dc793fc9ba4d0b86996cc14cd79def8f8c3313ab8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe
Size 24.2MB
Sample260723-b47y3sfa63
SHA256 b71918d3630b0b889247228dc793fc9ba4d0b86996cc14cd79def8f8c3313ab8
MD5 8ca4abec1384a18f5d37ef585d7990ea
SHA1 e0d4db270e5fc7911e00f58cfe57ed26a81aa2e8
SHA512 a82bae68d77b1572ae16f47b592b72dfe302a10995612f19284def6859d4b77af481ff6497d796c87cffe485130ab9dd4f8ced5eaf703023c9cb0ba20bcfd6ae
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBP:El
TLSH
T1D947980501F36A2B825473A0EEC4CA559F6A1A29D4F64EFF404DEF8D9E88859BF5F301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2392	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3672	2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe
2392	lsass.exe
2392	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2392	3672	2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_8ca4abec1384a18f5d37ef585d7990ea_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 35.9MB
SHA256 12eb38fb0dd449f45fc8d5782c7ad151536a572e9c1ed6a218fed1cbbbd4810c
MD5 f4378262ec22d4b5dd0297e97a9f29da
SHA1 8e45abb1503d90333864db341ffbf42e91618767
SHA512 bb2a361c73ec3d3a076664c3bf72a53f4b849a8cba3e81aa1d2bf9d9c233677e7b4445165c1e44e2d745e9cbdb8a56852a30c9db1344ceaef569d364b6d8e088
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBC:EI
TLSH
T18F87F9C14077AB9B42A473E0ECD4CDA0EB1A1965D0B2CDFB418DDB599A48870FFAE351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 1ba26399c849763d13a414b05a60ccf8e8c2c821128a9012207d11777e3caeeb
MD5 dbf4b46ab85ad5397e7f3911f2dd27f5
SHA1 d9b787dc9c0ee63ed79f5c5fc0ed16a40fc21a2d
SHA512 6a8ab24c231ef5ed608cec8320e0f23bbbaba266d1def5610c13493903cf01d2d8db13c07682b95eba9b04086302290d0038cea9de3fefbb192c7421f7b2e10f
TLSH
T1BCB01200C6F946211440912B0D606958C075BC481B4577002310C84D6BD180DF9D4302
MD5 SHA1 SHA512 TLSH