a5ed7f57f46d8c06a7395e778159b1a193c48d64db5ac8a27c7a9523e7a46556

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe
Size 15.9MB
Sample260726-3blnxssfmc
SHA256 a5ed7f57f46d8c06a7395e778159b1a193c48d64db5ac8a27c7a9523e7a46556
MD5 ee28dafb25217eebfc43654f5887b9b4
SHA1 8e7aa1e6a36bc61cd78370bbf492b550eb11ae66
SHA512 e7136e7e397d4e8af8328ee6fda305c6d22a7439df19264898fd2a231240645bf69fc41f669c54b00bfe8a8658fb76ebf89d21c52d49feaccca7de83f85369b4
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBq:EU
TLSH
T1A4F686AF84C1D8DEB0756221BA78FF2C8743A06D157D7FF44A803DADE5C613A6068663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5916	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5916	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared L\lsass.exe	2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared L\lsass.exe	2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3312	2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe
5916	lsass.exe
5916	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 5916	3312	2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_ee28dafb25217eebfc43654f5887b9b4_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
Size 28.0MB
SHA256 bd155f747722b38a06e54a1a440fa3901a9925a7a1443ace4e1e466babf9e9a8
MD5 a6cb3bae3b7ad6bf584b931725020be8
SHA1 44ba52cf837872173d555f7d71736ad9322bdcbc
SHA512 f91cb8a283edf2f2716ec367696ca74d581c82ce48ed2739a55b5ee258cf074d005bd886add432b88667f9ec258e2866f28569ed860f32fe585a3641085dae7a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:Er
TLSH
T13557C81BD583E4CA64B2622DBB6CFB3C974A61E9253A7FB549803E88D9E513C30D0573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 6cbfad954a7cfadec31beabef43de2b7222fba91cffe2252caa8bb7a2daefd6b
MD5 005399cf6315fe7d54a076c446af9d35
SHA1 2647127ef616577c8ad9d71d29dd5b8e4012197b
SHA512 90876ff491415376a4d1a2218b278c933e516ab0e51a0b9b2e28afd1194c4b244121e2ba79f398ebe2d4f7a44605b5f38308cd12aeea0daa9894c6a98928fc67
TLSH
T1F5B0122480FDD7120445511319A15C1EC1AABC0C595F2F4D0720FD0D5B8080BF5D9240
MD5 SHA1 SHA512 TLSH