7f8d04d44f7d64c3ee77c573ac998a68de6ae09a9230499578e93be51e356aa4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe
Size 30.4MB
Sample260804-m2pkhadj9v
SHA256 7f8d04d44f7d64c3ee77c573ac998a68de6ae09a9230499578e93be51e356aa4
MD5 89c8a376d8ea94183782251ddb3087c6
SHA1 d0de5950f1652f00801a57bb8ddb26ba9a4189f6
SHA512 ef8c2a8e610dbf95c95d49cbe391071ecc180d50e5061b8ba717dbae371c7764ad95a05b913c467b2c84a5a24dcc0715b9486138071114b0635d958e9b3dd771
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBD:E1
TLSH
T1AA67AA7659AD620CE89FDEF2B5D20DE1926951FD8FC260E4F299C80C35CBD24E1D2632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4540	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4540	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4412	2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe
4540	lsass.exe
4540	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4540	4412	2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_89c8a376d8ea94183782251ddb3087c6_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
Size 43.5MB
SHA256 560cc791b15dee8f20ca3f088ce652f3d12c445035a198de59b0fc33a98ca284
MD5 26a6d182a8c2a5a929bf60906416a0b0
SHA1 7ab1c3d46b5d34b4f43c370a790b8fa07764c37a
SHA512 8636b4410be5768aceefa3e48f5dfc3247d168bcce1eb528d6fb36ac699ecb0927a8298c7fbc90a304aafe491fe69e3211fef6476a48ad97bec725cf280db3fe
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBq:EI
TLSH
T103A7D93DA7A9914CD46ED9F2A6C30491D6C690FC4DC6B4E5F768C85C38C7D28E3E2622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 2a5c9768499a0c3247f2cc27eecdac420e31371a07aab5104a8b8bc092e090d3
MD5 84356bcb810bdc75065f7c2ebc3274e1
SHA1 6e26870c5dc0e5d05b1b6271608e465ba7bba45d
SHA512 dc44cd2f7d1eda648d211d66e7f2b2d4d6939b340eb45adf2d083ab8eb290f967c56f3444e7a202f95c0623c6be4c90c1995d6feea60f56a26d45ae439bdb831
TLSH
T156B0120081AB4E150455DC1726B04209A1607D0C1B672BC9C7208D47158180CB642643
MD5 SHA1 SHA512 TLSH