58d9c93e019ec1c26e32f99c4cbe89c25e8d45cfaeb59777407079fe586127fc

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe
Size 19.7MB
Sample260723-lrnd1sbd22
SHA256 58d9c93e019ec1c26e32f99c4cbe89c25e8d45cfaeb59777407079fe586127fc
MD5 db310c333b8fe486579188faee8f8256
SHA1 d4b01d119076334d04d196996ea5c86ce8bd0a20
SHA512 23905317c691e843da87304908a4d4062deb50979567193f93e92cfac9ceb347438c4b194e67b0426ad4b9e14de48968fe7cd1a7a23fb463d5a3c2f984c5d75f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBg:E2
TLSH
T10D27E9C4E810847AC47DB9C0D8D2C5CC7A0C9BD653E8BB3BD9A79EC15992C2ED179A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4032	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4032	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3772	2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe
4032	lsass.exe
4032	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4032	3772	2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_db310c333b8fe486579188faee8f8256_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 31.4MB
SHA256 66f8992a075bf119e24260992118acfba9425fe814d1413911b5d41fdc0d5e1b
MD5 a9dfe132c64dd94da5ec3154fe7baf73
SHA1 9c085642af52e13bc21a5a0c039dba52f2e978d2
SHA512 40e55f2c54a747cd66a096f1bc413d9f884199e8f792d3ac5a56356b687f6601d9672590f5b0b14059380761b1904c8053cb3916d2390b1a4106e74b029c28e0
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBx:E3
TLSH
T17977DBC1FDA0147CC43CE441ECD080CCA9499AA3579C773BBDAB5AC1D867C3DA6B9A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 32bb377135ac2933eae1fefe3f94bba6cea9e8a9f0a1d34924a4d5d73ab7bc08
MD5 f472639d860fb8e29955077bd5d1501d
SHA1 753c0873f217820fa65676e8c23ed7fba06de1b2
SHA512 c8f46cf57242d3f1543de13aa250cc81efad29a2db32e669ebfc472a7c45c1a427fa14fc6f4b6dd871433cb548176950695bf90be0052165c3da4b11744ef06b
TLSH
T1C4B0120081BEA5211040502726A05C4DE0977A0C3E992F55030088CB15C248AF6F5B02
MD5 SHA1 SHA512 TLSH