6e1d5ef7e7d3d400992cf309574d45fd0dc559f58420b4e317862d7b7cab24fb

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe
Size 16.8MB
Sample260825-qa4rwsyyev
SHA256 6e1d5ef7e7d3d400992cf309574d45fd0dc559f58420b4e317862d7b7cab24fb
MD5 56701845866b2fe75d1164d57ddb0dc8
SHA1 fca358a2299f948ea7152cc873ea4da9315c6569
SHA512 d6a7c72a3456e34e60eeca38cce5f3d905c6445e45c46b8d10cde7aa93880a86e09e8317b7632106bae5bf133b4c54f9a3bdb0ecfcf784c0513269e8627b2577
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBF:ED
TLSH
T1D30722B647EEC4B55BC482E9FB372D3878C933C743A981FADAFDA0C40298D6595845B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4352	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4352	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5000	2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe
4352	lsass.exe
4352	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4352	5000	2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_56701845866b2fe75d1164d57ddb0dc8_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 30.3MB
SHA256 b4aa3786c8cb116e48a28a2b422eea484f73f1d2bac61e5bbbeb171ebd61094c
MD5 0172965ae6bfe15296780853888ab45c
SHA1 7d7136f59aae59e8c94e731ddb106b362e5a7fba
SHA512 dafeabbc150b7ef7000199b04f86067f00ad127c88894fc243a97913a34418f44c3bcca21744efae6147ea404cdeb1a353d98e3744efc3a918b43beafc54619b
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBg:EG
TLSH
T15467967905DDC93185C6C0ACF6376D29B5D4B3DB03E996A3ACFC72F4234586AC8C92A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 d372390feffe24ffe73eb7ccb0cbaf0d17e8a84ed6cfd85d20ee013e49788d91
MD5 1135aa42a6e7100732c3629da4ead9bd
SHA1 22cb1f2e8c416be9ecda438abed61b4f0b313ade
SHA512 87e1f78f15d3fd7fe43d714c1c7a082c38796cdddfa54d4e81623c875e0428bc239c44d24fcbf1e9aa30961bb07ca5bd82b9375307c79bf0742573969b1a833f
TLSH
T101B0121083F9E55F1745A12B89E25048B0D1380879D517040300CC0D74C595DFACC591
MD5 SHA1 SHA512 TLSH