5c1edf077958e59d3b17d101a926e95fc4c6739ce28f92c53cd24e8797da06e1

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
Size 20.6MB
Sample260804-laxalagg34
SHA256 5c1edf077958e59d3b17d101a926e95fc4c6739ce28f92c53cd24e8797da06e1
MD5 de024bbc0d3f1cc32ab25fdc69f2703b
SHA1 118be856a3c8b8f8e04ec807d35368ab91487a27
SHA512 962332f628fc6898721854151a65a031ed2fae22373ddd156a8524741fc16485f997105e904a965cfaf236a0058cdb0eb96d12acf2f680fe135984ce69d681b1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBh:EL
TLSH
T1EC27A9DB369C2E3F5E12608751F5A88A7ACE4190C1D0689B83AF7475E518D2BDF2B433
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1032	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1032	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5776	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
1032	lsass.exe
1032	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 1032	5776	2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_de024bbc0d3f1cc32ab25fdc69f2703b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 33.2MB
SHA256 68238ba143579ce311792f101564e6932d73100480d2bd4f9a99f38f73ce19aa
MD5 98783b4fd59eda5b52741e0fd081dd5b
SHA1 2ffdfb181c70dd96078a067eb4fc04ab578ae74a
SHA512 fa9a52fbff3c007cbeb589d6d6e75e21f264008c724bf5dc4b8c4357dcee70dd4ca5fe614b49fbbee2674055eb6bc809c4953130b2f6066eee6e4d4c7fc5cb08
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:EC
TLSH
T16677F9DB356E6E2E4C05E88F52A49C8B16D98480C5C5ADCBC3AF7DD671088AEDF5F021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 99afee7c1c7cc7ee393cf05d9d3ae6d93efd5863f7c67c57146498cdf6e86f93
MD5 406ca46da8af92b1f512d66060be01fe
SHA1 baa988800eafcd7e65e4e79b5cd9fc51722b5a6a
SHA512 69c9d233907fa0589c96220fcaa047274cbd5c2a84b25b83b29b3c5815762336402b0d7c3595108d838bf3bf70331ac5cca934ba1ce0c7bc1a0f9ca007a2b707
TLSH
T1A0B0121440B949160C00701BB970614CE8A03D087D97236493208C466191649B588210
MD5 SHA1 SHA512 TLSH