8fa17dfef56acef81454c1bc9019b1cfb2b0fb2f31977ce5d7f72a9adfc240fa

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe
Size 20.8MB
Sample260726-3d4mhssfpc
SHA256 8fa17dfef56acef81454c1bc9019b1cfb2b0fb2f31977ce5d7f72a9adfc240fa
MD5 8b2e6cefb2611f39464524ae8fc8dcb8
SHA1 3037b5ec242631b9ef28151517bcdf08cc51ab75
SHA512 fbd4627558e9bd719aa7f67bca3d5fc225341a251b0a35e91d9b8f74e0583ead00da8a2b752999289ee1b86c91179c12e18df439e75df2a9e5934773cc4ec71b
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:ED
TLSH
T15727665A7EE75DC04A2437DB1C84D2DBCCA19C2A9D62C2B764F12A007785A1AF20F57F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3032	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3032	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2980	2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe
3032	lsass.exe
3032	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3032	2980	2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_8b2e6cefb2611f39464524ae8fc8dcb8_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
Size 34.6MB
SHA256 061ee40c2f6297a2f322634272b9ce181ba82a13cf23e513c6ef204b84abd688
MD5 1aa5edb1c207114a25af9567e4674f03
SHA1 91603d578203956cd41646f2ad4ab2146b26a2de
SHA512 ebefe8068229efc39888c34f769878475f7b0c4770b6c238646d664db5a1a525f627e55a5678ee3d879a712285a6be57167fa45b28aba9fe256475fb258b8dc7
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:E3
TLSH
T1B087C6B97A9BD9C4867021C73C8C95E2CD7A8C6F4D63B1A519FD86003B8591AF90B07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 8fcf89312a3cbd44d2b41580ab30342faf086379c9bfce2f00b8edc20e555e4c
MD5 a138102c092537a8db38a68841bc6950
SHA1 f9cb7c6b5547cdcb8a86334c076088a3dc085268
SHA512 0b09fa9f2fccae61da7a72c330afd87736656106279c439d5a26be25870bedd2ed1176f202a8f59bf1a84df81bb25e8288d130e8287b92a66f5b6ea1dc60337e
TLSH
T1E2B0127081FD4A5E1408902326740848D071681C79571708D3208C8D61C144EFCF0200
MD5 SHA1 SHA512 TLSH