81d798fb0de498c6cc4c995b406ff9f629455cd2cc8f3e747a4513234391d204

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe
Size 14.8MB
Sample260802-tmj5ssce23
SHA256 81d798fb0de498c6cc4c995b406ff9f629455cd2cc8f3e747a4513234391d204
MD5 f4731c219148ec4a3fefc71b2bb34245
SHA1 a560f46d9623077b95eb58fd9cf79cec878a6d0c
SHA512 1e92e2f5b190a97be53d43b8a02427dafce3017c680dcca79fd3faf40d67243b1b35c359fbf249b6c4e6cc054a240ed1c6e9edb1afe817c0adcd42d3b34cf5f9
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:EK
TLSH
T11CF6F24A1F2C5CD5023F2EBAE3103351A126569D87F8DE9F7463E96B703D3B491A6238
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5660	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5660	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
8	2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe
5660	lsass.exe
5660	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5660	8	2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f4731c219148ec4a3fefc71b2bb34245_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
Size 27.2MB
SHA256 f2bc4d8ff21016af62cec2d16eb3b00aa4af90e18fb798f5254ca7ae70c7c4fb
MD5 c113a75bd58aca480d54334a3b0d1738
SHA1 fa51419cc1bfbadafc0f0ae1ec642ba8a15d66bc
SHA512 b057587260975970c2004518b9d1557e0da4ba2a4bad13b460a460e1bdb74ea6d53ca4454284d3ffcb769f31d44bf7fc6f11bffd7b7aa682634ecfed4ddca43c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:EP
TLSH
T12557D70B4E2D1C5106563DBFD33413F0F263568E8AFCCADDAD579A7BB0396A5A0B5220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 8e6d3050754c7830e0193ef3168a710715278cf13e67d08cbae50ef224ca96c1
MD5 8bb4d098bb07f03754cbd90d5c72de87
SHA1 ad8ce2ce5201df16bba5181bd920233ed83486d1
SHA512 7729b34d37945e2080d0ba02e95314d79ab844a84c548d62eb85254846761fd2e3016f544c39a1635115ec91358e6582c6999fa63b2cd0b8993eddb3617206bb
TLSH
T15DB01204E1AA4E16154271270D64640CE02938189E6613185354D91520C684CFC9D242
MD5 SHA1 SHA512 TLSH