61ff7c762d7fd71783769f4f4fec023b701ceefaf37b5299208e104d1931eb25

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe
Size 16.3MB
Sample260801-bvtp4avdke
SHA256 61ff7c762d7fd71783769f4f4fec023b701ceefaf37b5299208e104d1931eb25
MD5 71c233d1eaadafb17e9aa129a744026b
SHA1 1bb808cbd5d330d3bcf472a281bc6830ab13f6f6
SHA512 211a90f5f356fd6f616f7050c8c3c60b041fec2514753eafa06ca2622fe30c80c5938da499f7ec09055bad6c2d2360cf61b0b161e1cf69db063c2f3ec00cb505
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBz:E9
TLSH
T1720769EFA546B2A7204B9F9123E128897143989F873D2335B17C35108C2D67F7DDA68B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1604	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1604	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4116	2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe
1604	lsass.exe
1604	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1604	4116	2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_71c233d1eaadafb17e9aa129a744026b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
Size 28.1MB
SHA256 3e1c082e5c391920e0db35d22005189a94526ee541901c4321821a373cf325a9
MD5 888622776d1575f4d6962ca9394a2d84
SHA1 93cae529f8f30b750d459e433ed72d44d7fcacc4
SHA512 3582d9e604eac956db29dc25780e73f3af3efe10b030027f96eef5362c51407724050092b054ca102636482ff99ce42570d43b6adb8e836dd9517563c5ed50c5
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBA:EC
TLSH
T1AA57C9ED982CA56F658BAF1A23532D8E71D354CE42AC37AB90FC75948C2A1573CC94C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 2793d1710209032b92b8471703e3b43e012120b90814404e0241cee55de97e67
MD5 488846ffec07b67a42a6ff022c115471
SHA1 30da98d6e9c266876aa41b194c93dae8878b3bf6
SHA512 0e4bc225e0bd2d1434d2fe109057b7810a9e76c403e6e3ac920a05bbf23f5242b254fc139ff7848b406eb32c2a8826242650a3661f703f22e1d0d33e15dfe12b
TLSH
T16DB01201C06D4E63100D52479EA0589DC0F168041D3513882B30C986B29041EFEF5700
MD5 SHA1 SHA512 TLSH