392026f53720bbc22ee6cd960a222ca55c5a3c8dc4baa25ae6af96300f5fca28

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe
Size 15.7MB
Sample260730-bsdabszwft
SHA256 392026f53720bbc22ee6cd960a222ca55c5a3c8dc4baa25ae6af96300f5fca28
MD5 8311e763c07d574692f074a4b0f8ee6d
SHA1 a4e36f073a13549bc1171214d1121b38dc8e8eb9
SHA512 f9482ece647ab6093349e38ff5b515bb78a13cc6c25207d145e3259248cee00ebc7e2190384c16254874dc092eba55af47a327e10167f56f37e0244ab6b90de3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBM:Em
TLSH
T16CF6743CFB3849E5D9B7F3EBBF07A292BF1B51A1A8C8113912DB5D81D05A2145EB025C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1628	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1628	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4540	2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe
1628	lsass.exe
1628	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1628	4540	2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_8311e763c07d574692f074a4b0f8ee6d_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 30.8MB
SHA256 aa19d0a55f8ca9122906bc6a2465854cf4519b5d837f0fc166977ad1e5c03f98
MD5 aefcc958967b29f794dbae71473cbf00
SHA1 0b34d3ec85ddd81a8b20e2f7e4f3fb1beb89b814
SHA512 9b19c343f177dac2dfeaa53ff1072f4dcbf4fdc47500a95c8c7f81999c70febe5a57cb55c27c7b919245f6ad48ddc0e3d1204cf3115f246843e87afc5ec1b8ee
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:ER
TLSH
T169671928A33519FDE6D7217BF34991E2A906C317F2F8912808CF55C5D5AFA061E73AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 7b9125edeb07eb110bcc7dee776d5ee59d4c00d0b6e2f84055174b77d69f1385
MD5 5b24810816df9e2e3c2629c7fd21b197
SHA1 6ea1fb80f77cf2ab81863b75ce2903356cfae33a
SHA512 de2f99151df1f82b8f86de5d9cdf7d6a5f2b50710b757e2d63e1611b49d264bab889a43740370966dac3a3783e6d0ab31dc0733a2b205237603e48099d1ad305
TLSH
T151B0120890BB8A322024601749B405CDD0B1AD091D5533484710C78A22C2D0DB7D530B
MD5 SHA1 SHA512 TLSH