1b3dcd8aa89cf71981a439dd5b075449bf7852fd95119e0a6c266e46ef301431

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe
Size 17.4MB
Sample260803-ttf2qashqa
SHA256 1b3dcd8aa89cf71981a439dd5b075449bf7852fd95119e0a6c266e46ef301431
MD5 ff1a73ffb3a9a8166183a380cd14d27b
SHA1 06da2a75120c07ce306204c53dd542b1382226c9
SHA512 92161455c2c6452752258d8615302cfa15d2ce286a5dca482a099528929a8d5697a5cae87265354b51dda650ecde49c843f3ed6cea85a0e948e162aca85c12e7
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:EY
TLSH
T190076568C8B2830CDD00E3978D4D9F3A6C9E29E49F9D29AE47507AD6C2462D12FF7705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
464	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
464	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4968	2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe
464	lsass.exe
464	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 464	4968	2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff1a73ffb3a9a8166183a380cd14d27b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
Size 29.7MB
SHA256 370f7a342849870cd26a7fb3eb280b2e2d5b73496ee3441dccc8785a67e253a8
MD5 642fdc767008756758bde1ff933d08c8
SHA1 57eb3861446fb3a414f2898520a774fdbd669c97
SHA512 e47da436946ebf1765bee7f44cd9e6835ec8b300f643dac0c560c1d8e3d8596b758e1a6a5982f8a2bcf988d94cbc21254099d50738ba690e4df7b83bd2c9dfbc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBR:E3
TLSH
T15B67A7A4CDA1618CDD02D3560E691F32DD9E25FC5AF417EB8395BE8F830E4900ABB725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 6753bada3776de8afe13f5288519f008604711a98b00112a385873cc667a7493
MD5 9167da8d9e6a9071dc4fb65455223660
SHA1 9ae9232c3c31efdc7fca441622f969f512ece09a
SHA512 aa549b85f35b42e22c8e339380084818b0d6275506f5ab0386fc111064595b6423ab2c6d746c639218b421574990e6fbf009f41f651db45bc25ea00c38b49abe
TLSH
T1FDB0124040EA9A260800904FA570588880207C0919BA775C8304C84914A144EF8E0644
MD5 SHA1 SHA512 TLSH