62c5cfd2f126120ad277faf7a6e69119bd2cfe7521e7aa2effda9b9119202b08

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe
Size 39.2MB
Sample260822-flexsseb89
SHA256 62c5cfd2f126120ad277faf7a6e69119bd2cfe7521e7aa2effda9b9119202b08
MD5 d642f99679848406d5dc9442fbf8d14a
SHA1 7726eff08449098e4c42fdc032de1cd59ae6d0da
SHA512 9aec86d2efd25121e373552188c2005f6a6754419b43546b90e1e278f62c80b4058369a26ee9932f4fc9155f7a63c03f8b4ebd46a993b66df789dc3d4d95e570
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBj:E9
TLSH
T18D971A2AF4C32772BCAC77DA3E4AFBD48A104BF878D150362F2136A66E15359974D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4704	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4704	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared K\lsass.exe	2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1396	2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe
4704	lsass.exe
4704	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4704	1396	2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_d642f99679848406d5dc9442fbf8d14a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b2cefce53004b12aac94c24c96c4193be734ed4b602777cdb4a194ca72ce40b3
MD5 a5fc95e8c9ede284a6fdbf29fa1ef48a
SHA1 0f559e33c60754763a17688b826563cb338686f9
SHA512 4a660d2b16308b217185737ebefbce8ec0d4b699780a94538d44f0d6d6014f178867033ec7487b16c6210d3492aed2eca687a1b68f62f55637dbf3036855a864
TLSH
T1CCB0120082FB8A22244174079BA0348DA071782C5B262B400704D9157580449FBA5290
MD5 SHA1 SHA512 TLSH

Submit Download