2a8a124effbd03d8211cb8ec59ed778847786725dcf28d6e097fd0c0acdd4191

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe
Size 15.4MB
Sample260821-dsymdahd49
SHA256 2a8a124effbd03d8211cb8ec59ed778847786725dcf28d6e097fd0c0acdd4191
MD5 1aefb30e6ff3b53500fa28ee56a59c61
SHA1 3b85e5ba0d10361fc1c9b538267fe6eebda8fa66
SHA512 7f9504fdd4254fdb5a97ba0a2aeeed4b19031445b52cef6c0f7a03b12034d006cef1e2ea6a5528bd1973fdff85a54ca62222431d3870a3a2918b6f892ebc60f9
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBG:E0
TLSH
T1E8F612D30127C7F7CC1D71582D262FC2EBB4A1296C4A866F49712DF17A93ABAD0E4670
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3224	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3224	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5528	2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe
3224	lsass.exe
3224	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5528 wrote to memory of 3224	5528	2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_1aefb30e6ff3b53500fa28ee56a59c61_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
Size 27.7MB
SHA256 e604f1de9149b3a19ea1c0de7a5d27bc88ea3b945b24b812d2ef2d69400307f4
MD5 29541de78fa1da02912f82a0ba113452
SHA1 70e2a028d4259962d8e2389f25635625149271a0
SHA512 059745bd027836cdcafe5e2c9f6b6251fafef5b3b4fb183bd7209bdede5306ec6174402dc46776cbf9168efab8995fd02ef26448be2b187cbff310a37b7c611e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:Er
TLSH
T18D57A9CAC41287F6CC5C780C3D130F86C8F5E12658698B6FCD757A703A5AAEAD4F1662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 76617b5f370ba84cd90d7eb9f544ab1bf6437367042d7a34a9489565c588c824
MD5 e5a4c1e4fb707a2989f564682eb9f2f6
SHA1 ae93b668074fc412a1ae699ac5dbf1dcc2e4cf07
SHA512 c02820a1fcb4d65425b71816cb741a6f3b947936903bc7b1c019049e12e4c417bbed35220b0702f11c951b52187ac6b8cae9f22b328678b6789c7d2e7735d617
TLSH
T1B6B0121045FEC9553CC1D06B4E70604CF3A17D081D5617022351C91424C085CF4D1500
MD5 SHA1 SHA512 TLSH