dec44e7198e0f119ef5ecc378aaa3376232fb164bc74dcc70cf4d7063f3b82aa

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe
Size 14.3MB
Sample260804-phtffswxav
SHA256 dec44e7198e0f119ef5ecc378aaa3376232fb164bc74dcc70cf4d7063f3b82aa
MD5 3e674d566e4bdae75b6fa014fd8c580c
SHA1 3bd5c8e368f7cda0baa98cbd4e11930f0a2e270a
SHA512 4dbb7360939fb02a52eaea7da268c5c938c2a2ee4ea4d668a0ef94258ca2a0441ee662fdfe7af6400e3ddcfe4c175e3484f754c42a1780fdd7b4acfb51796dc0
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:Ex
TLSH
T154E61107F4CF6B22AAC89C29859A3117092FC1197C95E5F5AE0F684F504B0E3773B5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2060	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2060	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3544	2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe
2060	lsass.exe
2060	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2060	3544	2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e674d566e4bdae75b6fa014fd8c580c_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
Size 28.7MB
SHA256 cdd053d9b84863cf3a64ba4d9a6a518f13a37917d70c099c5e93279a1288a439
MD5 0519620a47f65e396ce5c097abc82fb4
SHA1 f59a5156c130e530c8a9d1be0220edd0802daf45
SHA512 58a5d72f9c82b4c7f31a44582e5be4f5fd52225720a7542ba50e32baa554b9d45b19e4ba5df0d0c550fa11a850d9d685e52b920722df366f61c4f334627aa0ba
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBy:Ec
TLSH
T132678425F4CF4F1B87CCD82E0987A9570DBFD1163C828A785A0B191F19872E67BB219D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 2cffff7b4e046e485597aabb6dcf02cb5cd4531a80fab118dc38e539b0ba576b
MD5 9bfa28a1da73bb8db0b58384bed3f592
SHA1 f3d4f5fb550719d1c4a08c13cb2cb25edfdcbcb5
SHA512 5c5e0afe3131ea14fd8da317e13391172c66b020edbf1a2b2bdf2cb7702811dc3bce130ed17a39df6a431b87428ca8aec4a1c6f842454f42fd6a7cb1541bca9b
TLSH
T1E1B0124141E94A161401A02F57B0521CC0547D046E7E6394C734CC0E34C244BFA95680
MD5 SHA1 SHA512 TLSH