9748c4023a3e6435c7f8b4433fad6710feedd70ff21d06e72b56fe837ff8c81c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe
Size 13.2MB
Sample260731-2z33faaa74
SHA256 9748c4023a3e6435c7f8b4433fad6710feedd70ff21d06e72b56fe837ff8c81c
MD5 f7a4015a4bae524de023e50cf645aab3
SHA1 85c585681df1461616e9f9c50530c1d82e687ed0
SHA512 d76d833d7a8b4ab3a7744dd96526c5b9f4d1bb2980cf89bfcf7f2b6811681cc97e45db5a54eda81625e885b37203e756b678694af59a9ff581f3cf4bebfe88d8
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBr:Eh
TLSH
T1B8D6530074E79D155B5160BB63D6AAE82D7C68F8B00B8ED0BED09874670FE8D25C16BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2448	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5000	2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe
2448	lsass.exe
2448	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2448	5000	2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_f7a4015a4bae524de023e50cf645aab3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
Size 26.3MB
SHA256 5a9b0961b169ab6db2c1efe3936730dce499956d45ebe70bad077c725636b708
MD5 c2fce4359ac89f2f6948aa0f753d8ebe
SHA1 1999308d91be11e4b275e2de2a6bb6c94d0dd15a
SHA512 598f7da7b80fd51014510f6c878aa78d9cb3d5ffad83f2d2f714ee54cf68277d3a1dfbce003a73027da0ad8c52aabadc2cfa639895a66148ca37d341fe486b09
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:Ev
TLSH
T1CD57B72171875E19A92031B73269E4BD2CF840BC700A8AD4FBEC5436AB8FDCDD79949D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 d586ecd97ee2a27035bc4ceb97dea44a6d2eaad5906857b9094454156872467b
MD5 6ac26b7b90683af58b0fc8106ecea208
SHA1 e267bf7af84a99936a6cfe6b3891bd332608c1cf
SHA512 01c2e21ec5a242d9d7823a43509f62315ff5fc4827d630d188b905829ed0765a8d168a59c5f9f182cb7b2a0241d008e30a00e0aad70dc1b661da577b34d9f1d4
TLSH
T1C7B01208416D4B522009B0030E601A8CD0B2BC14FE5927491720C84622C040DFB44141
MD5 SHA1 SHA512 TLSH