c71ca5d0841933b60390886b9bf651651d5d5aa6ee5ace9b96389b30f7b31c4c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe
Size 16.9MB
Sample260724-bbmgnsel3z
SHA256 c71ca5d0841933b60390886b9bf651651d5d5aa6ee5ace9b96389b30f7b31c4c
MD5 3ae1360b2273f4c1da32f4e797564b44
SHA1 bb8c8ca12d2e32fff9f4c516adf283c08702fe5b
SHA512 626eedf2cc3fab3ed35f2a15c54a838fc45dfc93ebea64c7fce002253316604cc0e148644608dd0ef1c80c5a2f140743c393296ec3b3e5889cef3e2e9c190036
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:E+
TLSH
T1770714060616EE55FC5FBD8116BEE0AB43B9AF5FB650183AFFF6D2B2105528500D28BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5536	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5536	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4148	2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe
5536	lsass.exe
5536	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5536	4148	2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_3ae1360b2273f4c1da32f4e797564b44_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 29.7MB
SHA256 e292a54feb1b8d3efdd40461e96559cbb6d972475da1345a72e6fd340c4656d9
MD5 f7e19d69bffd72608df6721144dfffc4
SHA1 2c57188c4815bf135a781e60434c2a0441143f4f
SHA512 e8f82311407bfbcbe96aedc2f2a2a518edfff2d273d7acf002681b160a3293e868bbd6ae29890efe6178d90d3ffb0491bac2007a9bf940da55ca4fa6636aabab
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB:Ef
TLSH
T1E667750B0605D6C9EC9DF90461FBE45743F9DEFBB0151C29EBA6F276245A2C264C2A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9fa2fa9d14e95e19936782ab7432d5f238fbbd56ea5b109f5e5615b1bb4b3806
MD5 caa4e8b130f9c02732b1c02125f99ef4
SHA1 7993293e9f4a99c531cefe6e171a3bade0730e03
SHA512 9edce7b7bfeec3956575d379f0564d7a2021b36c2a9e5aa32424152465a7f57e241550f15bbe5ce21c12aee47a1baa84de37538432d0bb573a62e74971f181d0
TLSH
T1FFB0120C81FEC5311444622755B1880CE05178082A1B27749300C4085AC4A1BF999200
MD5 SHA1 SHA512 TLSH