79420d81e3f69754a7063cb900997f99a2cf3f7d24607d8394bb2b70c0962ff7

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe
Size 18.6MB
Sample260801-blm6ysvbpb
SHA256 79420d81e3f69754a7063cb900997f99a2cf3f7d24607d8394bb2b70c0962ff7
MD5 dc6c0f23917c11fd363d09620e699038
SHA1 a246e3d175d3165a1420ecb66dee17d6daf09bda
SHA512 deca12bfe6eb6b360ac6a4d092c51dd0ca2d7d9b19e7e24e0b05dd3f67b69402bdd86f287d262094adf5f4f9bba90b574abedd1e0d56adde775fb3f86400e0aa
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBs:Em
TLSH
T19C1765B8B48DB65111F8A93DD7AAB222831D14B61F3117F603B36CC9D51D9847A32EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3300	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3300	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3528	2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe
3300	lsass.exe
3300	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3300	3528	2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_dc6c0f23917c11fd363d09620e699038_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
Size 31.3MB
SHA256 b5818ae38b49aaa4991090221299f6293b7201c648554d3788a47725d95bb117
MD5 57c4a2a281b237a0c7f620519902076d
SHA1 52db72345a213a32bde31afc77c72fb0ba34137f
SHA512 2f793e20837de2ca33aa4acf1afa2b3478e80c5c5ce5cace10465caecff842fd89dd3e607481bb20f472881745a5a9a7b08ea6805584f64abc714c2022a0c6df
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBZ:E7
TLSH
T1EC77E9BCE94D79F066F8E635EAD6F312935639361F32137303A22CC6C4199406A92EF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9e6091644e399e031d209101f440ef472cd9f3c803746ecf1c14fb41d33da916
MD5 ea165cff27940be1ea47dc467caa7b32
SHA1 b4bd76017e87e75f640817ab1d55667897c90a05
SHA512 5b3ceffb9491f01ed021b0b9b4e898f340e10ae7454049af158bfdca912bccc64f2108fae78d48ce446b1fc7e56aa28eab0cad8fd4577c5f85adc3eed8693abc
TLSH
T1BCB0123480AE4B51100891135EB3448DD5D17E042B4D33448750891937C1909FD95100
MD5 SHA1 SHA512 TLSH