239057984036fb90daa4fb169c1ad6860614349f2ebcb7f1ddeb35f852d5501c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe
Size 32.0MB
Sample260804-pywkrabb58
SHA256 239057984036fb90daa4fb169c1ad6860614349f2ebcb7f1ddeb35f852d5501c
MD5 25c8f90658c391afe0892ffe992e4c42
SHA1 31c8b9c8e5f4adfff2e27e9481a51acfb76697e3
SHA512 eb50668d91182a60216fd8d374ab5c970fac3e46f2754b4057fd33285820980ad1e18a4d8a8d5496c826e55e4773524a0808b9945ced95815032f99817f0de5a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBw:Ey
TLSH
T16D77D86002359709E94BD76D930068D67A2563839EE3AA7CFC9D9C04D07F6898AF3FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4332	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4332	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2760	2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe
4332	lsass.exe
4332	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4332	2760	2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_25c8f90658c391afe0892ffe992e4c42_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
Size 46.4MB
SHA256 0141a49a216567d55ca6d12fb9c0b4f20fbdc70183f52207ca8de9ac784fc6a4
MD5 6604791462bcbd4282c8a10c4e928041
SHA1 87e7f33bb868a84a4753df0953c66f19b0b20e7f
SHA512 fccb703d9b8ef14ef6837472348b2b7979fe6b948fc2315686c1700d78848f9ded752ad6f78867f62742fd4e621ce0bab902480b8625415b387cd159d344f315
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:Ew
TLSH
T1C5B70AB48277778A998F4F1C27029C5A3E2067955EE7663CF96EDC04C0B70648AF3B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 81e789e505c91cc2a9f406326da5b6d08a6008b4251c8e074df011bd1c7b3972
MD5 6fa973a5317d3b04839d6c1aabeabfbb
SHA1 aeee354c3857b8be1d57cddf3bf817152c205aad
SHA512 c854aa06c244767da6561b09959d2849a832c0a2f510323fc863749cabbc95e112a19a563435c2eb53156eb45dd540ab8856077ab896ad788b836887ac3e9f96
TLSH
T19FB0124440F9451B1401F05766E1104FC0563C14591F97109700EB9B3283448FD48200
MD5 SHA1 SHA512 TLSH