77543ec5e4360f73eec33168b03bd1a93efeec361cd43a7ff78326233eb15121

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe
Size 34.0MB
Sample260723-b5drmayhla
SHA256 77543ec5e4360f73eec33168b03bd1a93efeec361cd43a7ff78326233eb15121
MD5 887cbce6f71a93b80831aa007ea60647
SHA1 b5ddf9a6640cc483f6aee2ae316c04720d2d33ec
SHA512 fe5d4d49da1a9a6cf4bb7d4b33ab353e5e5d40568ccfd0d721c2c3b5d4ceabb85f4145f852b89981d96a5ee53e0f7be26413991ed9107491bf27ad85268e8b34
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:EH
TLSH
T18A77D5C27FEBDE454E9798BFC3022A6953F06DA1D6E4090C143B3807B5173BB994B6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5680	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5680	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1884	2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe
5680	lsass.exe
5680	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 5680	1884	2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_887cbce6f71a93b80831aa007ea60647_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 46.2MB
SHA256 b298d1190764bd390bb89858939162ce983390a048c89aa76d8589f98f60c792
MD5 f636b5a0419fe5d5a934892616115177
SHA1 f6ebbb89e63a141a81b9fe0b0759b7b72b07abdd
SHA512 e5e06091a95dc27dbd91dad7c0d457c5e5ea950d003d940e8ff91fcb693ebbb3aace0b61fea9b95c077fafca89df5e8eaee3e05ff1f807b44abf64fc29b5aac8
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBb:EF
TLSH
T145B7D8D276FF5F564D83A4EEC3029E7846F4AEB1C6644A5C103B3846B51B3BBCE494A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 dbcaffc14694154104a3c2117a33f8d12921f508563a5078df9d0a60723b6479
MD5 ff7f77ee82b6e4d9e941b35547b79102
SHA1 8050ddd4eaf77ce854b1dde9f8e9e72dc6c8406a
SHA512 dda32040f89bdbdc6d8424c91f984029ce666c4e1d5076daf5bb006a718d8df0cd4068b756ee8135084122fd5b964547bd0008697de0ce452863497385ed8803
TLSH
T118B0120040F94E662404E09316A01909C0927D1C5B59B7D14320CA085590849B9D9141
MD5 SHA1 SHA512 TLSH