5c1edf077958e59d3b17d101a926e95fc4c6739ce28f92c53cd24e8797da06e1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
Size 20.6MB
Sample260804-laxalagg34
SHA256 5c1edf077958e59d3b17d101a926e95fc4c6739ce28f92c53cd24e8797da06e1
MD5 de024bbc0d3f1cc32ab25fdc69f2703b
SHA1 118be856a3c8b8f8e04ec807d35368ab91487a27
SHA512 962332f628fc6898721854151a65a031ed2fae22373ddd156a8524741fc16485f997105e904a965cfaf236a0058cdb0eb96d12acf2f680fe135984ce69d681b1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBh:EL
TLSH
T1EC27A9DB369C2E3F5E12608751F5A88A7ACE4190C1D0689B83AF7475E518D2BDF2B433
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4384	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4384	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
896	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
4384	lsass.exe
4384	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 4384	896	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 33.2MB
SHA256 0b1fbcae320f079d3c604f1ad5327add8f8b700dca720a92ab50c2f1d9d1af8d
MD5 19c0bca8496feb789a239fa1d10130d6
SHA1 04a62f74b5d5e2008f4d82f483a686bc1dbd2d1c
SHA512 1e9ad02d310130c0d41893c7e976a12062185f8b96de8daa8bfaa9b573ecdbdcc31992db977cf825aa2b81f053674ddc96922bc21eb2e3688da6aea0b54ac3ab
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBK:Eg
TLSH
T18E772AB77509BE2EFC12348621B078EE7D894D48C2E0884A8FDB74BE7954505FB19E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 99afee7c1c7cc7ee393cf05d9d3ae6d93efd5863f7c67c57146498cdf6e86f93
MD5 406ca46da8af92b1f512d66060be01fe
SHA1 baa988800eafcd7e65e4e79b5cd9fc51722b5a6a
SHA512 69c9d233907fa0589c96220fcaa047274cbd5c2a84b25b83b29b3c5815762336402b0d7c3595108d838bf3bf70331ac5cca934ba1ce0c7bc1a0f9ca007a2b707
TLSH
T1A0B0121440B949160C00701BB970614CE8A03D087D97236493208C466191649B588210
MD5 SHA1 SHA512 TLSH