e8b276f78a07a63151762d9669f3f3775b8c80af415732d57cfbf6aa14986899

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe
Size 38.1MB
Sample260815-e1hfssztas
SHA256 e8b276f78a07a63151762d9669f3f3775b8c80af415732d57cfbf6aa14986899
MD5 0dddb8774b2c980540261a6ca4c2a6c1
SHA1 69ec67535b19202f51d926f499a1219afa6556e6
SHA512 56db45a4d971b4a7f703e6faea6ec340426a79ad608634be67493306941da96ca445c6ddc3d9e3ca2e5a65cb5af58572908a91f361a6b036cad168c09d9958d1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB:E3
TLSH
T1EB97A7CDEC88D4EBF0155A5263024768F25F412671B78A93421CDB61BA0BC1A8F7D7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1632	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1632	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4368	2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe
1632	lsass.exe
1632	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1632	4368	2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0dddb8774b2c980540261a6ca4c2a6c1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 dfb4fc69a59dcdaa96a1ae4259c94ebb88b49c79805ab8c2a65f4109dba8d2bc
MD5 e74a3ef645ded38b825c4b09d124a08f
SHA1 7a25a76964a874060c844a7c91855024dc3b40f6
SHA512 b0615ffa7d5d0411f245fc0cc825bebe9fa56d56c7f7d3ac2ae5b92b92bf21435e6e3218fb6e38f8f259f03f56aa3946d07b75018636071ab512d231112b0ed7
TLSH
T1BAB01200C6EE56211841511B597A3D0880207C853E0BD351972196099280D0DB554142
MD5 SHA1 SHA512 TLSH

Submit Download