8cd964c3ec26b7012e001e09694ed8f429b374205c024724e5f166365e1321e8

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe
Size 18.3MB
Sample260729-zaex7ssblh
SHA256 8cd964c3ec26b7012e001e09694ed8f429b374205c024724e5f166365e1321e8
MD5 6accb4e3144525f47c91aefd9339c8dd
SHA1 584240953e1714cdcd1faada2aaf43d9478fa904
SHA512 1c0989ddbfc9a7facef116ac78dcded39bdf3d4119d7649c257277f2299a73d28cdb5cc67d933e2b57a8e493bc93cd647a90184a7b3c1b0e5cd430ba4f9b1a8f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:EI
TLSH
T10A1726DDA014805BFEB5EB4B4DDF6CEAEB37FD0C3B808455BD905885AA807F64026B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1328	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1328	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe
1328	lsass.exe
1328	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1328	2380	2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_6accb4e3144525f47c91aefd9339c8dd_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 30.4MB
SHA256 4db650054db9e3d2c133e72b5788246719595c0bdb8c06cbbb205efc384b7eb0
MD5 847122ae4e3508488f0962e07d084928
SHA1 b21aab4c5be835612f750ae39d1bb28177fd6711
SHA512 d2f05051797c5eb4ce3c3cb7dfeca0cbf764d874baae467958695ee4327ad28efa0076dc0aa47b13a9206e8c909345a46867dab044a2e42d8281459fb9aedaf7
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:Ek
TLSH
T14267A78D6066800EFFBA9747955F6CF1EA79FDAC3EC18569BE81768152803F5C02E90C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 c6166da84149607407e62b24ba5eeafc88a5c0b33cf7cdf36a0663a1445a363a
MD5 764d204c4207bdaef943a0589d9000d4
SHA1 0cabd2dcc2935ad057d6c6df68df6c38a50e3712
SHA512 2fb124e7af1cfaa9652220f74516934dc057d21a37f5ffbb205693969901d250a250b55f9196d1e196d5259c1faaf9eb585fc9575f7e7b4156981554e60079a3
TLSH
T11AB0120050FF8D51290566578671054CD2B1AC081EC513886301A54B51C540AFCB6500
MD5 SHA1 SHA512 TLSH