2ee75b82c22c60e7578b32bc7164e53b29f023ea6280a0cac99d85dd03eb8042

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe
Size 39.9MB
Sample260810-d8vwesvsdz
SHA256 2ee75b82c22c60e7578b32bc7164e53b29f023ea6280a0cac99d85dd03eb8042
MD5 fce536b479332da4d130766778ceee30
SHA1 d9c9c23ccfb0430920361fd24b0136b42e68e4a2
SHA512 429f849c1a3bb275f30ca4a30480d162371dc28247b65181e812759a7b8a13719df98eb2f8a099e12bfe232c5681349d0fbb5eff87bb9cab5371965e417c4729
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBL:EZ
TLSH
T1BA97A898EE94E3A76C70182F751178ADF7C5B1E3D2470E97DA7D889E0AF8920279C40D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
816	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
816	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2180	2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe
816	lsass.exe
816	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 816	2180	2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_fce536b479332da4d130766778ceee30_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 7aad35508d2155e6247ce22e7260811e14dc3bf7970bca764f1e7feacd9d6d32
MD5 8959f94ecba0e9eff08d7863c34174ad
SHA1 c431a668e2a11d5e415f711bb23540537bb9769e
SHA512 bbdd70431fb6f71307f77d6088f6375367c66daad59fc10d554a7d3a2605e185a520ca2b1466ea00a6d8b2507378e4ee4447f8b032e45bdd7ea5fc318b2dc8e3
TLSH
T1C2B0120084ED49212805641B99B6410FF830380A7F797300C7008E5410C06D8FDD1140
MD5 SHA1 SHA512 TLSH

Submit Download