6aa42fd6dd191f54224aa5f176252cbc50c04244da44ffffe46f68523f40e01e

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe
Size 16.2MB
Sample260805-abkgmsaf44
SHA256 6aa42fd6dd191f54224aa5f176252cbc50c04244da44ffffe46f68523f40e01e
MD5 f9f4a7f9485800ab65824d43569727e5
SHA1 372fd581050f8f403465bde6928bd02b2b4a57a1
SHA512 41abc1a78151d8b77ea48975427cdb73707a4d1af6e7ebf6c916ab5de0936ceca9e5ef5a8488bb60431a457fb0e261571f356fe6913ba8bfae0dab7c66267d7a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB8:ES
TLSH
T13407A6F2403EE19191620CFD87D2151F8CE5AA81735AECA8F05D62887BDE3198ECBD57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
796	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
796	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared D\lsass.exe	2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe
796	lsass.exe
796	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 796	2580	2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f9f4a7f9485800ab65824d43569727e5_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
Size 29.7MB
SHA256 58951c8e1e1abc46fbce9d6163b25115747f9d965ff2eccb6b80ac99ffd1cf55
MD5 a0cb6c1ec0239e2522e9938f2f20f58f
SHA1 a149faf1ad56ca436274c0fcfbab8c4360a62f9f
SHA512 9533f60d4e1ae8eca07abdb2447723da8a37a8dad1ff8ba293b5db6248886f1b55421d66b80948ffb285b9bcac43b4f2bf1bdf3af4d34ebe05405cc4d9e0431a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB9:E7
TLSH
T1906794C445B6F6229EA70CE503C61ABF8C645E81B529AE1CF03592E97FC94204FDBC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 cf26c48f82a7949952f9958122c889db143ef80c657b4d42a600d8f2e10b20f3
MD5 ea3b09839cb03a25d416def4f14ebea1
SHA1 038974d1c0a118561460ade1629f058d13a2fd17
SHA512 cc476465c9aad1ffe7961237f5bc6d665fba79f394184510df3f658786ced9765268010bdc705650c5b0e332f7a64e204df7d96dcdbc5c32bf8e24564dbafac6
TLSH
T1BAB01240C1A986634445701796F0114CD0153C041E5D231C5B10C94A36C1C09BA91250
MD5 SHA1 SHA512 TLSH