5141c58b86469b8bebd30d956a8e26d312ebc2cd5b66ebe198d308ecf0bdc765

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe
Size 25.6MB
Sample260808-dmbkna11gs
SHA256 5141c58b86469b8bebd30d956a8e26d312ebc2cd5b66ebe198d308ecf0bdc765
MD5 93e22c668c99d0c91b3a3027fe837549
SHA1 6f02569b89ef51dfcce7dfa69ee15073dc5d31af
SHA512 2668d6025b73d097a3cccf8c29587e24304af170faa53a5e69acae484d45e16eaaa2dd61b42a6a20eb1f8e92af85556a3eddabd606b06ca0c995ad0d08fbeec7
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:Eu
TLSH
T1E947B76744D0850E71E6DAC9CCEF6230E9C9B3FFA60A4866CD60CF51D4D5AC9892239F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3844	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3844	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe
3844	lsass.exe
3844	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 3844	1736	2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_93e22c668c99d0c91b3a3027fe837549_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
Size 38.9MB
SHA256 0645a38e141383abbc994a311ea182727d7536eaa0643708ba3e654d61dbd498
MD5 58c5f0684ce1200c83fe06e437504a68
SHA1 1c91a7fb1419b58aabec00be6624b88749187385
SHA512 da78331d410672bc35cb23dd7a3568d043e358b11eff9f66ef24c4bc0c87bdd906f622452097caae11c72a65449f66fe24ab5a3ada03340779a2cbfe5876159b
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBO:Ew
TLSH
T16C97986A94A4571DA0F2C587C9BF6330F9CD52DBA20E18254D71CF52DCE8BCA897234B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 f5619bdc974e004bbf36f91894fc016197ed58f739d646f62a13797209174998
MD5 9b1d913fb6ea17df82575ed0938af949
SHA1 f994182b8ee2438428c845559f7a5a5c830441f3
SHA512 49e4977f84b8cb00b8da5924ab2596bbd2898c5b05a493a0d2b67f72c1e84109370e39a0e027549057b1f613a204cd8182c3e2bace71fb9bd989e335f6804b75
TLSH
T15BB0120040E9552A3888D02F8A63D1CCC05278086B191F015749ED1E218294EB961701
MD5 SHA1 SHA512 TLSH