e96410de8e5d1e0df565e0e55a1afeeafa2a83cf9a876bcd7f7819528c0fa378

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe
Size 16.9MB
Sample260730-agyw8aaj41
SHA256 e96410de8e5d1e0df565e0e55a1afeeafa2a83cf9a876bcd7f7819528c0fa378
MD5 432cdb54abf570332bf6f111b45bcfe6
SHA1 b9e407782a2258eb3462ad62a8c9275adc06fe40
SHA512 9ecdc43b368db0efa705f2200e0914b449b02950d1d32a31d8308f35e00ac8f045a9755c29c78ea6be15d389fe571b79e586f4e46a75ad98125c983dd79c2175
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBT:E1
TLSH
T1D607953E2C6CD8697F2C692E957F67F68E98233A9348B50FF460B4C31070C6607756A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4908	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4908	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5084	2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe
4908	lsass.exe
4908	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4908	5084	2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_432cdb54abf570332bf6f111b45bcfe6_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 29.9MB
SHA256 713dd7e8d83b2f7bc3ff64e714aba66d69a5e8bf55f25219e4b6d78032aa9e1b
MD5 6b3f91819e62cda55d46c07023223047
SHA1 fcef72ea49903846afe5cafbd332ffcaf4837ca7
SHA512 c786c82ede3e4a9e2b879930db727a13bd23312f31ceae587910cb0f7ae101e1892b15b41510b080040ec1b2b4bf57caeac4ff89ae84ab17a968c1acbaf17248
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBs:EK
TLSH
T1D967C92F4D18D0DCAAAD2A1ACD7FADA96D7C67A9C248B327E410F4570570D3603E8C9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 51ae7e37c1678133ff2af8a1680b1900e951162d3be6a75caf0182820abe5446
MD5 316150980a023dc12dde0f283312749a
SHA1 46795136158fd53dbfe907d9160191d06b44d41c
SHA512 a5a216ae008e60d8ef38862cd7e84fa62fd575b94fc05d10882eb3ba85d4249a29cc14fe1be116bd7c6964777475b255baaef61f45d207b08c9994878f348576
TLSH
T180B0121050FD8917148060175AF0460DD151AD08ED8527C02370894C178080EFD90140
MD5 SHA1 SHA512 TLSH