b05c5f0b181409f1ed6bc7d390263b9ebee995e937323d3ed292ac6f3db5ebc1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe
Size 30.0MB
Sample260726-3fsm2asfph
SHA256 b05c5f0b181409f1ed6bc7d390263b9ebee995e937323d3ed292ac6f3db5ebc1
MD5 5670406654771a498112de17c31f1c4e
SHA1 2651d7eec5635ff7d1f2aa5ed5db25a57ae7cd8d
SHA512 f8a5b7150858f8edd992382c82e83511f15c6c8919c4923f4383192c1910110085d5cf3ad3f1a791418257083dd3b691a29f01732c25e3dd6d99b0ff70ee0d53
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:E9
TLSH
T14B67C9456DA7325364E45B811FF42F8B161F13A8EE38989B879189CF10FAEDD1928F31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2568	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2980	2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe
2568	lsass.exe
2568	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2568	2980	2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_5670406654771a498112de17c31f1c4e_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 42.1MB
SHA256 4a265f1222797caf74336631a9923f7dea338a128571ecd160b4664cbd7dcafc
MD5 f31fecbcecfc8183c78171f0dcb5d111
SHA1 fd8d695aa0476c666a0661c772b8d1ea125bf078
SHA512 b74014631a35f7fa329b9ebcc2ab778a38fb5bf31428acad933d4808f82622a9e6c88a78733ff787f0614d6c7359d1493078fdd3058f13a27ae020adbf1dc7b1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBk:Eu
TLSH
T1AAA7E7695D26338774582BD96FE41ECB292FA26CEE38944E87854D8B01F2FDC15A0F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 28b9b4e9c161eb3b04b56abba0e6ca51e124372a45104eab948af8069b6dc5e0
MD5 170fc25afefa99af1b176930ef2d4690
SHA1 464ea6c866344d17d9a852bde7aaa975a19b74e8
SHA512 55c592aeaab57bc43371a0e98d155aca71cc81fcf195f53cad52c1dcdde5b684556ab2ae5a4ac433ebdf7eeacdb6c608cd5273a085cc95ab210cf21749c761b1
TLSH
T119B012019AFDC5611044B0070DB2CC49C17C7F0D2D9B13790F40D519278044FB8E4610
MD5 SHA1 SHA512 TLSH