8eece1488f3473531e72a6969a3bb80ed90c84793465e34da95fd7f31fafd527

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe
Size 28.0MB
Sample260815-eba1esybkf
SHA256 8eece1488f3473531e72a6969a3bb80ed90c84793465e34da95fd7f31fafd527
MD5 657edc8084a7d0baf09b5a707f3db44e
SHA1 a0ef5c804700f4e60efe161bf38b4688594ae70c
SHA512 52de96ae0b6095b42598ca42c56bc5589d1137887c86cb196d837beab0d0ad0bb94c83f30f0bedef51ec73c11c4b7e4bf4af64ab44ee6f947a19e939f2fae14a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:Ei
TLSH
T1AF57EA4367BFB3EA62FD763515EC8715C2074ABA2F828D07C3477893D50C622AD2466E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2964	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2964	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1612	2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe
2964	lsass.exe
2964	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2964	1612	2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_657edc8084a7d0baf09b5a707f3db44e_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 42.6MB
SHA256 ae5ce0ac56c88713273f767a1daa89612821502a1feb026441a6f976680c075c
MD5 ea4ced2d20de2dfd838082b410517c07
SHA1 907ad7e53d08c29881050f7700af949f958506fc
SHA512 724e7aab641f3195dbc4c0fd48a84e64facdb06c1e42228b9220e1836fbc21e02b8158234cb9ec7a125974d0815819e70f9c3e82e4b8ea907753a0feed033cdd
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB7:Ed
TLSH
T134A7D7D2A67FE3E915F571347CDC871281474ABA4FC6CA8286077952E84A267CC24B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 aab55f0ea068ba6c16989aa2f838abf89159bab19faaee1b346890277c36571b
MD5 d4babf322c235bf637dbe09c8aea8c0c
SHA1 ce296e01c9a2270ce5e63731a768a4aaa563889a
SHA512 1902fb2972c40351cca91d17db6caf33bf2a203886b20aa537bf5280d2911848926c7693c6d611a978de358bb639be7a8df3203fcb3a21b4640f30948c9a1b63
TLSH
T161B01200C5ADC5192885E01F56B5219CD03E3C472F5A27681318C4047580888FD82342
MD5 SHA1 SHA512 TLSH