837c3030619ea53a72180155b7504206910078c7a4702846b8c2bc2ac640f22f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe
Size 19.8MB
Sample260804-ntrwbsdp5v
SHA256 837c3030619ea53a72180155b7504206910078c7a4702846b8c2bc2ac640f22f
MD5 60c82630788cb5db3aadff7fc35f75ab
SHA1 98ea06648fcc72166cd391d2a4aad9fb58b7ba73
SHA512 976c3ef29fd6f0ca53bc857647d54c2b91af7fa4f0288cb9a7705faa7e91ca812888107e5f17fd63259d16afab01323d38afb5410fe7a13c3b7b7272c19e0eaa
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBi:EY
TLSH
T1B227A6E83A7DC060875F5B10A6A30572D27E17ECAE9E40B8B70C7D97199326732A4F74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3560	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3560	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1244	2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe
3560	lsass.exe
3560	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 3560	1244	2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_60c82630788cb5db3aadff7fc35f75ab_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 33.1MB
SHA256 1b384acc895c6c2e0f1b7c87f4902e2f112e93ff52bb366597940028298495bf
MD5 d5efd667492d79462a9466a55cdae02c
SHA1 6918f51b8fdbaa8730d690d4ab10ff2764aa1381
SHA512 e0d7c201b25a2dd290cce42db10fef16b48003a70bf50d0fb9c10b8db3e7ea2ddb7df187b565f5845ce0a9c850ea9278afb7a408c938743f646f251f9355abee
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB9:EH
TLSH
T1F6770BC03679D352560E9318A6A56070C97B53EC8BAEE1F0B54FBD9B6E891BB3140DF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 50b02c3be21ef10ece9309a6b94b0a059f83ea4fce99ef93f34530ab410ea00a
MD5 eae3fd85e5b59f310daa1bbc936de578
SHA1 e2a8d8c96cb02241adf26a9ee7752c23209b1f1e
SHA512 ad77db586a16809c1a2f4a103bc75ed8abea52cdc032cb545c28450bcdb3c3e9dd2453edcf32f6fede3e94417c19a005c5bf2176cec688dad3c9af093ff84598
TLSH
T1F2B0121040FAC913184AB04775F5300CD572394C2AEA17044328844691E0489F98D701
MD5 SHA1 SHA512 TLSH