bbfdc8f1d0bdd3fd6831d6a945c2d055e1db892443e38729615d1573d512c83e

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe
Size 14.7MB
Sample260730-abgqrayvbs
SHA256 bbfdc8f1d0bdd3fd6831d6a945c2d055e1db892443e38729615d1573d512c83e
MD5 8c6be24a5b6813b743b03ecfd8d711c2
SHA1 07bd11e078712b740d635775e380999db88c5e63
SHA512 a7c269a483021a81e877c78252f8cc28ff36c82a6abeaeeea7f03dadefa3b69c08d9fa6dd16f95155e4820b06e65e90bf3947eea9c2a1a5229d7920cbc68a49f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBo:EO
TLSH
T175F633586F1ECD21A43519A6C353FCABD12255EA9E5F725012D0B20B13B3A73E03E67B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5912	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5912	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5368	2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe
5912	lsass.exe
5912	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 5912	5368	2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_8c6be24a5b6813b743b03ecfd8d711c2_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
Size 29.0MB
SHA256 df8088974e59ffff42a4ea7b2c379760819ac73f0e59091e076df6fd21e16ab6
MD5 8846f4032baecd95aa36fa4bb694c78b
SHA1 8faca0c4287cd10da0e21c7b9b21ce1f7931ffe3
SHA512 29f7dc6476d85d41650f5c9846fe4640cf338616dfcf1bf16e8b1344e7dbf84bf5f55397a2c8e5f4d04c263986dff4e38b79cd27a356faafe04e277f0440131a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBT:Eh
TLSH
T15D67710DCBAE986185304D868E46EA6BF82659284C5FB5B40BD2F52F17391B7F06F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 777028aa8bc6adc7f168bd52be72541f376c1867f8195c8861f75d3b7b44fcbc
MD5 e5a539aba2ac43aae2bf88acafffc5b1
SHA1 2963474602c588012119610fdf2a2648fc550567
SHA512 1a44a4272c65b3a4a11d8781e9dff62af7b7fc94baaa7c44bbc7509f494b3b0bad511a25fc1b08b632b3f7cde9654a018578df40e2fb6456786512a3599ee15d
TLSH
T194B0124081BDCD521840502317605849C1A1FD0C196D13441350CFCC568149BFCD0102
MD5 SHA1 SHA512 TLSH