a0eff65c0148829371f47f26a60993478b36b477c855525bbaa5a045d39ca375

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe
Size 24.6MB
Sample260726-3dvdvasfng
SHA256 a0eff65c0148829371f47f26a60993478b36b477c855525bbaa5a045d39ca375
MD5 92220125ffc8e00e04898fedcd30b083
SHA1 9e4b24775ccd60e4474c491e249c9cea39330f13
SHA512 50b2d445844ba1c4f7d483a3b3b0c9c62863d9b4264b80f6a4a98379617457b236baa3407b03edc52c93654c15b1719818dfe5114d9510e002b2a914b07e3486
SSDEEP 49152:EPqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqx:EK
TLSH
T18B47A78E4F0F6B93C24D0931097D74AC4A8A057786D5D0B7A8AB9C83EF769978BF04D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
860	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
860	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5068	2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe
860	lsass.exe
860	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 860	5068	2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_92220125ffc8e00e04898fedcd30b083_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 37.7MB
SHA256 75b5b8299a1768df8b76d04f91e523a9d217a28e48049f363988983494fc9050
MD5 226370d715f2d87039b68f42e68b73d6
SHA1 c331c6c5cb3a043afc07fbe41a0fd36e7ba1cd61
SHA512 3b14c71cd7e9f4d901195aba2a1cfd958a1b9a432703e818a011b66d5caa4fa280829eb1307afc5a1befcafc8d0399db069a2c224e4f9b9130297beb9919f864
SSDEEP 49152:EPqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq+:EV
TLSH
T15B87B84D1F0AABA1C01D1C24047EF86C04EA15774698D0A7F8F66D43BEBFA6B87D48D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 46ecb0743b3b9504428dcb7e5a77126f402915965a6a313e1ed49a500f2de80b
MD5 1934ab5ab16fd94156850a8033f08883
SHA1 b88d7c3050cbd5163e3d896c4e009b80e540947c
SHA512 447cabab9ce8e58a9c9a57bcb493c780f35772977a50cb1bba914ba85814cbf63404acf67988ef5441bb7d200a026cb1911e8d7bc2d0bfae9720dbfe37a554f1
TLSH
T1DDB0121443BEAA1B46D4601789F11AC8D0D1FD8C3D0617D00B14C44C2E8190DF8D0110
MD5 SHA1 SHA512 TLSH