e3dbc10f8bdc69a54ac48c23dbb63acfd136c669150f9cbd420ddd54e652775e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe
Size 19.2MB
Sample260802-3q514stfmf
SHA256 e3dbc10f8bdc69a54ac48c23dbb63acfd136c669150f9cbd420ddd54e652775e
MD5 c19d7656adf6208cbe7d426c2e10d8b4
SHA1 21697280e266f2a3b8228b5383aa8b1b4852650a
SHA512 f49300b9335afda56315d66046f833cd175611acc0f05405efa514cf1b3df7ad3dbc84e1dd4ef2979d08c210e73c9b350dfd9496c014e78b0fea6a014502788f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBU:EG
TLSH
T1171795CC9374CBF5FC4E2D795CD217BAA33BBA24B01BCCE644656A1A4A0F9D4C141A36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4440	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4440	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe
4440	lsass.exe
4440	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4440	1688	2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_c19d7656adf6208cbe7d426c2e10d8b4_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 31.6MB
SHA256 2b10a2cbbaacda871f90ea93b8af6cca66f8857ce9a53f36e3efd05ad9557e0e
MD5 ca0af5b6575a0548a8f251fdfa415525
SHA1 be97aa6480c7a017c52e655826ae876dd170324d
SHA512 babf98232b12cf5fc981b2bb5caf773c3a76cc6f78ca91b8038165abd5581f003f1e7d7a71536495aaa76f6ed9998395ec701b8868d63d67f6a0aba87821756e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:EB
TLSH
T10977C88A777EC5D5781C39390EF603B69363F925F04ACCE647F58A2B970B1D58021E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 e113445fa289a562b4d62641373449a1ec0e19cb5f85b2bbc8a509a13aa1ba13
MD5 70d93499d51c2318fecef202da1744fc
SHA1 902cc8810b6f30768cdba6589e2b04f4d8862023
SHA512 52e5267b857fb5781041425042ddc119166b45f8b2db0432c2346dc187d9c20ff70e034f8b1308a9788001dfc6f8133f050cfa124d95d199f8c9ee6ce6ca16a1
TLSH
T1CFB01200C9F9CB660C06601B19B4080EE0253D0899952B8CD700C48425C0849B946103
MD5 SHA1 SHA512 TLSH