7b255cc4b42a99ec8970e78da271ecbc9d179d2706591c4b32e00a7f6bded567

Analysis

max time kernel
149s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
Size 27.7MB
Sample260730-dnjmnayapd
SHA256 7b255cc4b42a99ec8970e78da271ecbc9d179d2706591c4b32e00a7f6bded567
MD5 9ac06cd6c3830d6b45b57482e2291802
SHA1 8767a43b14ce3c6e7815a12ade911aa2c51fdcf1
SHA512 d5d0c02604bf2d4c7bd067e21ac80d25f0f8f57d05a874c6a5d0320291f51a5c6fd4452584f584f4e321bd28ff0a4c734617fcfaa64bf29601a800150b22212b
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBJ:E/
TLSH
T1F157D63D30DFA4D8A5176F818B65E5329F15EE088ED92E8F5691023E13D9A270236F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3040	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared L\lsass.exe	2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared L\lsass.exe	2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4508	2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
3040	lsass.exe
3040	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3040	4508	2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
Size 39.9MB
SHA256 aac7eb8d1f6e99deec95c555c5cfaaec26e6e0e75c6a4b2fbdc058165950bb58
MD5 0a299c6f8035e7adc0343cb575d0c757
SHA1 aa2d368a68036e6804d14bf18ffdc45686ecbdb0
SHA512 0eefab819c916a3c5b22e5c4a58420be197b850e728b12df7d063d3c580cb28423b6ad5281ab4863be497c87b9f7ee93ed7289af0eccf9e8848199e464a5f084
SSDEEP 98304:E/lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll4:N
TLSH
T15697083A208EA8866543FF454796F7268F552B148BDD2E4FA2E1533D21E6B171322F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 67873a98633f5c876fbe4042e580fb94489b45c5fb061687f6d1c58c2503b7c9
MD5 d26121dbf2d5c26fd2e17a0ab1565451
SHA1 2d68c6551b755da54c05d3ae1ca8ff9dd9ebec1a
SHA512 eb1623be98f2af4c6e8ef3f05d21fbb2fe7aa4d574792b135ad6b7098bb2ed155da5d5284e66ff5269d465fabb82b196c19e96b6f74a6e6a34339bf8cc1907a7
TLSH
T134B01280C07A8DF32588501319E3485EC4B1A805596DA3145310E50556C5C4DB596104
MD5 SHA1 SHA512 TLSH