14bea1d3383609a4bcb77d7b9718b27b4ce25925d6a06af55496af5b49e0c572

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe
Size 12.4MB
Sample260804-24x2zssflc
SHA256 14bea1d3383609a4bcb77d7b9718b27b4ce25925d6a06af55496af5b49e0c572
MD5 391aca0e61aadfab296c069d7f0b1855
SHA1 53b9d6853fc9508bdef70e58c12ef9ce209efe08
SHA512 52251cfee7be34ec15cbb4b3da700ac3f297ba7fe7358d5a8efd53aeddb3050bdbadefcb9c7111543c4816e76429be3db8ce782f3aeb6e2c1325afb7fff281e1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:Eq
TLSH
T113D6D65CB404BEBA83FA6DB235B13140AE6707A3378C7C40C2276A762F65962CD5764F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2492	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2492	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared G\lsass.exe	2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4684	2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe
2492	lsass.exe
2492	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2492	4684	2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_391aca0e61aadfab296c069d7f0b1855_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
Size 24.6MB
SHA256 556c6e0b17ed42daf0c79ae80fedde0afbc01226c9b7a7e05fa3d61437152139
MD5 e348de5d29bcfcdc26cc484792a0e038
SHA1 45cc82cecbace048e85a4a3dccb0f7bfaf029dc2
SHA512 dc16b662382f673a66ee3b3a28084e909b22af216e59a9163963ac23858b0d90cf542fc592298b66f9e2cf081b493f2c526bc42031c7813967e5777e35700e5e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:E5
TLSH
T12647FA58A0377D71037638235A8732AD94ADD723BB18D901E43EBDB557AB078CCAA44F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 3935657f11eec2070df1ce4a90e63351b1a476e23152bbd0b98915926da9be26
MD5 c89acca650dfa9b76e5c7c051373a221
SHA1 7488e2198c6c7c768ac00234abd300e3fa464b7f
SHA512 cd50afde9299bad6067c6b63aec9c11935f2f271e90f4c468f67815c7de38b95e469e505b9e0850dd1764e92290c9d97cfd1f755e07307a130eafae1a7fce7da
TLSH
T1EAB01285C5EB47711450B24B1AB15149C0B77C442F691B008F708A4815C391CF950105
MD5 SHA1 SHA512 TLSH