845c756d324b319e95233c32baf3c713137685693d4eec1b3d5a36aa606c75b3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe
Size 30.6MB
Sample260804-2bdgwafj3x
SHA256 845c756d324b319e95233c32baf3c713137685693d4eec1b3d5a36aa606c75b3
MD5 b87cb921adf8504820419b8a6e09f406
SHA1 007fb6bfc36a38bd3080c353211b20d64c98c272
SHA512 9ba72f6046b95fd40e129153734c761315eb20a94893f00963892db2cb5202f7e3f483a4534f4017ea5b16be1eca148ea00d31a62525da04dc49cc7dd1954a90
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:ES
TLSH
T1F967D88D74A8FDB7C1B5BCAAB37134C0969A87A726DCACD6D52245F3AF610032C71247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1808	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1808	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1120	2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe
1808	lsass.exe
1808	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1808	1120	2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b87cb921adf8504820419b8a6e09f406_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 45.2MB
SHA256 3b4b324951dd988d0955064da697b37eb05fa3c8ce7838487b19b047e7493727
MD5 582b19e88d80ae721f6e0c9d495caa63
SHA1 efb73319c1a1d691a4bae9afae144d06fd7a4e9e
SHA512 c73c08da838e9ef4761f83cd49595a2471cff3820eae64596bec904214e7e0f5bcea61b27422ed90040922b6f36fc5af1c9552d8df2003d7bbf8d4a018ac8061
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:E5
TLSH
T145A7FA0DFC9CEDD3E6622C06F3B0A4C5D69603FA32CCC8A5E26646E26B761471CE1657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 17c23f843f00278b0d9fd667eca00c06d08db7e4b7bd6520f70a9ca4023ed2a8
MD5 54db02830175850f634d5d96d6ca6586
SHA1 65d2185fa72d78b8521ec2eb7cd1bb16b3e9156d
SHA512 e621c5d3382906c61ad9c3feb08eaf7a23bbc12e4379e3a29be264ec41c8b126fae5f8bed6d1c860ee1fb12750b1298fa853a23c5ca9d578a882543fd2a17ea0
TLSH
T1E9B01240D4AF86173403B20717B1440C8C537E142F5527544B30CD9617C140EF642210
MD5 SHA1 SHA512 TLSH