10a38775247b4d7398ae947d336309fc2b8e80fcd75bed4495a632534e06ad19

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe
Size 34.2MB
Sample260804-ngbctayejd
SHA256 10a38775247b4d7398ae947d336309fc2b8e80fcd75bed4495a632534e06ad19
MD5 740423f9f13f9c23ee1a722ba11b49d3
SHA1 8a517155c632c82aded95842a0c4082ffcbf7759
SHA512 a10a256a0094e1bb30f658e253780e0590551745a0bdc05241737231cac62c3b609714bc19d0f430f66f6287f3255330e731e66080355dc4a92ca585bdbfdf92
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB+:Es
TLSH
T1E477B722BE8563A9C518587F85C8B5567EF1B9333CCE53F4A02E873DC726A144B31A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4376	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1464	2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe
4376	lsass.exe
4376	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4376	1464	2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_740423f9f13f9c23ee1a722ba11b49d3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 48.8MB
SHA256 84b5eaf1ef5d2626002803ad2be53774b758de232f1804e2aa2f65890f76a684
MD5 5b627b8f9e9cf64e27e6074fb08b9651
SHA1 f6ecf81759970f5df77efef4f231bab159ab0a5c
SHA512 5969c9def8aab20ca34d3a7a8af32f0491267f01be171231721fff7cd5ea564b267e89bd153c2efce183aa674674d25e49c6a16686fc034be01e098383291f6e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:Er
TLSH
T1E0B7F865B98A326AC109187B88CCF475BDA276933CDD07F4901EC73AC7B7629063663D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 fc640e6b72d9c7532309594ae67dbe38c3f78b46a6f650ac6ec9b0803bf1a253
MD5 94ad30e06ff42fae68795bf9ac2f1d92
SHA1 0e4e5d5807ed9f89f6492d97042f9cbf42c1aa94
SHA512 e4ae0187ecfee56a6b84bb7c0392b9e54490dbe2908bfc2acee50d37d5389162594939ec5b6183504579b4d74d76d7efbd56f144707f086189b7fda3eae7da77
TLSH
T1A5B0120090BD85150401641F3AF1120DE15638095F261B90D700854A20D0C1DB8E0342
MD5 SHA1 SHA512 TLSH