d0dc01d85c25f17cff0a889581771c564565b1e6b756cd73fe8c377f724dd7a4

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
Size 18.7MB
Sample260729-yeazdatway
SHA256 d0dc01d85c25f17cff0a889581771c564565b1e6b756cd73fe8c377f724dd7a4
MD5 bb1e3e70380a1ec1fb67ec86966ae052
SHA1 5d3f49b4c3db5f5f80a24ca1334a8ed889ccf8f2
SHA512 f0451ba0c4257294947d2a0323661e9c0efc680c962e8cafbcb98a4d2e45409c4c8528601311dbf6a3b882b55b3890d74113288db5f03a3311404377b49618fe
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:E1
TLSH
T15A17A76D6086B8B8C37A0A78ADF12F0C6211FFA839305686EC436BCC7795CA4F5D455E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1116	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1116	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6072	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
1116	lsass.exe
1116	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 1116	6072	2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_bb1e3e70380a1ec1fb67ec86966ae052_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 31.6MB
SHA256 190a780595668c47c7b90579a2f37180abd24d54f112271657bc654cb33e7e53
MD5 41f48f1702f47276e76e16db4ae14aa4
SHA1 2a091163618b782841ec230349eb9dacd913ff21
SHA512 c0fdba84dd11fb11f1eb9b73a2b7cb2aa2be1e1e0a122a8c02cf394bb080df59189c967a6be8fa465465de43570a1d02cb84005cd52a8cf2607fb8b05f783efd
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6:EE
TLSH
T1E4770AA818D1FCF5C15E05E8A6DB3B285935BA15383132C7F9A347D8BF06C98B2D49D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 6c863b532a1eec11d9653170590bea4ce408259d33ce49251d462d50f6107055
MD5 ce7b44f160456de48793600ccb768353
SHA1 640bcdbaa819bfb12097e882d95ebe4541612996
SHA512 b38b3708d0788a1a264b978de58141457fabdc08fc836cebe55956facce8c31e221e9c3398e348285a7c56b294d8803af9f8525cdabe79a2e0464ba6b30803a9
TLSH
T1D3B0120085FA4E39534960278AA0E81DC451AD081946233883009988A68180EFDD074A
MD5 SHA1 SHA512 TLSH