8c12fb7069ba6f05d939b273fbda47e771b4abfcdee195315a1263374659beb8

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe
Size 14.2MB
Sample260723-b7wp8afa74
SHA256 8c12fb7069ba6f05d939b273fbda47e771b4abfcdee195315a1263374659beb8
MD5 6cae534b707f026233a80512ebbe661a
SHA1 ef82de83516ea8febf60b3ecfcf6de27efb147d1
SHA512 d95a6b23ade970ac64333618bf028e3f184de0b5b9d48ec371588973acca6dad65e432746ad35d869a08dda401dfcb85ee254669275548c66f1f0a5d1f546b9c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBw:Em
TLSH
T176E68786C3BFBDAFF40127315AADAC09C88BB039B54FD19F30F0E6146506D5A6AB44B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2028	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2028	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5008	2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe
2028	lsass.exe
2028	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 2028	5008	2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_6cae534b707f026233a80512ebbe661a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 27.2MB
SHA256 f1e18536a1d1e2e133daf3c6dd89c0157c6b9a718efd8acafe9c7d3eb99e9e50
MD5 b51c76c5df83080b90daa8ea8dd817af
SHA1 3fdc6a7cfb03cdfc44af8620fb9262ae918c8dd9
SHA512 4ad1f5588b684a9c88b9c0e07f081cebbc96ea3b7e211f17f18e120db473d89a26018fcea47cf4b638d7d90ad94350fb5fbe4314d7d0157058f628f2b0f26ea5
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:Ed
TLSH
T1A657B840567FFE5CD14A07B2A2BC4E4BD0CA542126DFE10A32F4C524F683D7ABB985DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 84c3db8c4133a6693268f0a3d8f58e0c76eacc7c52e23513ad3792ae3e629a92
MD5 3f57a41fbca4f9a1dc523925abd2630c
SHA1 a41f4c037f21c13d6d6f70ba3f56284f72049a54
SHA512 64fe9d4b253d9364de3da3f242c5ef73710e59f45240471cb739150bc27d34081571abef726de27a04250b5e6010aeec2e23c2eb05ea917d13ad0ad84ac67b69
TLSH
T1F8B0121081FFC52D050071034E62121CD0A27C485E0573048390CE4957B14CEB6E5245
MD5 SHA1 SHA512 TLSH