f1677e175a9f1bd26dd204da3ee3ef2c7fee9404936ec7774a483b9b9be8bdda

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe
Size 19.5MB
Sample260730-bzdvfaab48
SHA256 f1677e175a9f1bd26dd204da3ee3ef2c7fee9404936ec7774a483b9b9be8bdda
MD5 25bd292a185a36f74386782b3a668420
SHA1 8f02f21531c63dee3bf90dcc94f3fe3b0a86cfd8
SHA512 f2597d9238d41ac91f5c9b674ec99cc447960d688e5d2423de07d888b3a3b6270b9a304295956984f2edcad32ef8d61e179a7963a72a3d3359b8f65323b32251
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBy:Eo
TLSH
T1C327A828123C1D64DBF0F6BD7968BFD9C64D122034249E96D7A511E23FAE5FCBA83094
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3220	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3220	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5272	2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe
3220	lsass.exe
3220	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5272 wrote to memory of 3220	5272	2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_25bd292a185a36f74386782b3a668420_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 34.5MB
SHA256 45c479f63c38d13f540c3c3e0735e5be5da47dcbb3eb7e8341e49adfa3f5d507
MD5 2c2036f547dee852c0e5a0020dcbee3d
SHA1 ac80618ee885e18367f8e0638a91bef4fea71e3f
SHA512 311c67b11f21461c171551c07d27971aee20211122932c084493794bd0053b1de636cfa0c115e8a21b73ab390c1d09697b55ae788e1732d80d4a4cdc4d54a27c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBs:E6
TLSH
T1A887B719017A4E1C5DF6F7FD3D5EB6AFC20482657110C3D3AB6A22D33A4A1B872E3568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b522cd82e1a575f27677dc50a86a9d77a0ddac22c3cdc4911a7a7001da82f356
MD5 5500373679c651b2a7fb7fe0af4b25bb
SHA1 0807d74c8aebb1644a524768e1bae08d7b33c817
SHA512 c9303927524fbc2e4b245da15fee46cb47533b29fa342c293a3360191c58ee8576d08b326b054f54fd34aec99589ec4e061efce2a0de0515ab1b471da3001309
TLSH
T189B0120081E98511100450231FF1AE2FD4F86C241F5D53000720D884338194DF58E1D5
MD5 SHA1 SHA512 TLSH