89c0f1b1ba0ae82dde71cbdf39c1dbd5d7577878df803f65efd19e7ca094f70a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe
Size 17.1MB
Sample260730-ee99paswaz
SHA256 89c0f1b1ba0ae82dde71cbdf39c1dbd5d7577878df803f65efd19e7ca094f70a
MD5 1aa7a7b5a0afbea14589c6463cb73b3d
SHA1 d4c8b80a1dbabc3b7b1b3a8ea2a45a5ec2906523
SHA512 02bd9e6a4bd60ad80667f5ce98169a66f02ae522798720aadf558bfb42d6d76871518a413d09b1195742f84c7ea2ccda9f87b964c580df98ed576b060a9a5b9e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:Ez
TLSH
T14A0751F8084CDA9C934074D8595E9CBBDEBC37CB8288454D68C58361EFD63228AA5F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2912	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2912	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4448	2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe
2912	lsass.exe
2912	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2912	4448	2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1aa7a7b5a0afbea14589c6463cb73b3d_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 28.8MB
SHA256 94bb68ec84d1bbbd200ebedecb091dee8b02c7dd1bb29da2d9fc25c9bac3811e
MD5 d541cfe63c7ca00bde33685ec296d45d
SHA1 985136aed96d962459358ec3fb4a81cf1f816b7f
SHA512 a23df17795bba366bba78317aeb0483bb5e87e2f6093324a4a53f4c484b5a669d8a1de2a9fb178b9cfa143b7b96d2bae897ea847788e86001b3959eef6fbefc0
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBs:Em
TLSH
T18B67EAF6081D999C5AC470D8994ED96BFF9432DB46087248A48283F7FBC71724DF9A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 f68fd8b65e7f6122982772c7ced3ce1e882fae8dd587fd835d219bba1c5c3676
MD5 3741ec4ca324d1a0d0d53ffe6e6beb7a
SHA1 a2c9500c40c2c4c372ae538a03c8b38b55adf4ce
SHA512 3f159a6981e40b26f349593818e7b4776b95c9390da43c842452af706a46b9a1938e6c491cf996ddb7f7909aa6cd2a5d7756054ea48af4b2f211605180a5bc5e
TLSH
T103B0120044BADF130089501B2FF0450EC460FC0839493311131088446A85549BCA4340
MD5 SHA1 SHA512 TLSH