11f0f2b339c97c6cd62821fc20bc8f81879a786528b19e8a23f71388f4906d21

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe
Size 16.6MB
Sample260731-wcla8aeb98
SHA256 11f0f2b339c97c6cd62821fc20bc8f81879a786528b19e8a23f71388f4906d21
MD5 7d8be08431d2801e33968dd8f0fe4a24
SHA1 bb9990e9752c04b6c27d09705be74050c5b5f1c2
SHA512 a2d6d4a1990935c1073f2ed007d413e60de54caca9e2fc729852bbc071a0336c77b25f542afb28db0a89c79172ea702e36cd10c528ddfeaef2688904fb05fc4a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBD:E9
TLSH
T1B3074F8CB1A05884F20F9CCFB1900DB56ABB0CCA2177AC754F697DACD268C1D9C67AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4876	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2584	2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe
4876	lsass.exe
4876	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4876	2584	2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_7d8be08431d2801e33968dd8f0fe4a24_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 28.2MB
SHA256 ff1d9f7b8338f6b17e3e09f9f2cd877ccbdcac2c05e8809119c3fb971b79b6c8
MD5 559955a889e28406ef343853094f08d9
SHA1 389a3067c0b0a967c2dbe3a00ccc5ce4266f0ff0
SHA512 103c8a6d973689f1cea811b58b82e3c3ea33bbd9b2998eafc648866229a3d311d920bb9353bc14aa9a5a551ce10ad0505280aa221d916b5c11899960a29b518c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB8:EC
TLSH
T12C57A849B9155840A30FFCEEF24054A9B97708AF2772AC365E14BC6CC26DD0D9D27AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 844976f38ec4bf3a6c7a2dee484aea2c3e06c26e4cc77fbbb15b4924ddeb447c
MD5 964ade7b282efc9df839e2f0536ebb6f
SHA1 1691d368cd9ff5ff70ecd4e311c0d218e5d51ebb
SHA512 7c8d828e80fefe465c71d2e7fbc34ce39afc3656fb727e3ba25453c038918e83ceca0b3497f3a2fef084f60c7393753430c5d7089622b63269ed170642969319
TLSH
T10BB0120045BE89A52440902F0B62424ECCA1B818BE0A130847108446528048BFC60121
MD5 SHA1 SHA512 TLSH