252fd5e1d92d953509726141a70669e1867f40d41511a9376a061775e47764c6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe
Size 28.8MB
Sample260730-dvpr9aycme
SHA256 252fd5e1d92d953509726141a70669e1867f40d41511a9376a061775e47764c6
MD5 752e567ddd8ba6ead5430799ba7bc8c9
SHA1 c642d73682b37cb4b624ac4629baa3ad3bf998b5
SHA512 8435def36d422de9d05f10850a3a6863949aac9ba293292aee660abc678faf32caa1acae092858f76ee8e69eaf0adc8c92ae4fce2a2c17722a9ec7a2c2bb58cb
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBO:Ek
TLSH
T13867A6AB72504A3C117DB463F764E06486D89465C2DD78CE8A36F3868C566BFF20CE8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5320	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5320	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1820	2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe
5320	lsass.exe
5320	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 5320	1820	2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_752e567ddd8ba6ead5430799ba7bc8c9_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 40.6MB
SHA256 ac784e4a2865779e9f515c328cb22a315d4a53c84b43c184ba3440ec84022584
MD5 2d222aefa28ecf35986161b589163db8
SHA1 ad532503fd25089cf99a486ef78ff765edbfa314
SHA512 bbb202a13dccb3313a05c00b164e751f4900df6a99c78d02132ac3a91f0e3bba24d1d7f9bd8d471478a0c4a8dab060f57e3bf8d44e4ff8c5712396daad8c6aaf
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:E+
TLSH
T1FF97089FA2408D3C1179F093A368D0B58AA4A9A980DC24DDC97BF156CC4A3BEF54DF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 1259d75fe9da324b482f4749b38f1982a0ee3284ef887653dc913ff1fc4e9cb9
MD5 8a18bd4dabb2d6d64e5fc0d3393af0eb
SHA1 37e31ad5f712aee745299694225072b5e52424f7
SHA512 710eca1c7b50f92d1e29332ff6bfe4c5215fb2c6d0e72a060aedac0f51688f207bc01df18786f1feec5a685282f8f7e4f34347f7d3ce6550e1c53c5955c6a79e
TLSH
T121B01200816D45351840B0170D71140CC0E0EC082D4713A43310C84A33C5999FCD0180
MD5 SHA1 SHA512 TLSH