d0dc01d85c25f17cff0a889581771c564565b1e6b756cd73fe8c377f724dd7a4

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
Size 18.7MB
Sample260729-yeazdatway
SHA256 d0dc01d85c25f17cff0a889581771c564565b1e6b756cd73fe8c377f724dd7a4
MD5 bb1e3e70380a1ec1fb67ec86966ae052
SHA1 5d3f49b4c3db5f5f80a24ca1334a8ed889ccf8f2
SHA512 f0451ba0c4257294947d2a0323661e9c0efc680c962e8cafbcb98a4d2e45409c4c8528601311dbf6a3b882b55b3890d74113288db5f03a3311404377b49618fe
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:E1
TLSH
T15A17A76D6086B8B8C37A0A78ADF12F0C6211FFA839305686EC436BCC7795CA4F5D455E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2184	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2184	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4880	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
2184	lsass.exe
2184	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2184	4880	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 33.5MB
SHA256 ad47cdec07b8f47b6820a98f86130ab3341281e102b46bf026e40b7aba273696
MD5 13615ea353ab3062365f128e1b085c53
SHA1 5d07adfd5de4a01004479823c1b8caf49672caa0
SHA512 dc9582b12ec1d8c1a089c5ada55303ea342722a99df7f515ab0cf98e4aca8b4b683a36e792c8649789d41197f45fd4e23095a01ee5af82bca38ebffbfaf8d00b
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:EV
TLSH
T12977C86FA19CBD79D33916F48FD61F8CF150BAE030B496CAD84693CCB694899A3C250D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 6c863b532a1eec11d9653170590bea4ce408259d33ce49251d462d50f6107055
MD5 ce7b44f160456de48793600ccb768353
SHA1 640bcdbaa819bfb12097e882d95ebe4541612996
SHA512 b38b3708d0788a1a264b978de58141457fabdc08fc836cebe55956facce8c31e221e9c3398e348285a7c56b294d8803af9f8525cdabe79a2e0464ba6b30803a9
TLSH
T1D3B0120085FA4E39534960278AA0E81DC451AD081946233883009988A68180EFDD074A
MD5 SHA1 SHA512 TLSH