f4e7b5bf6218adce51216b89c3ace556de06bdaf7f859c5e4c2b83fb796edb1d

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe
Size 16.3MB
Sample260910-mn3j7sge83
SHA256 f4e7b5bf6218adce51216b89c3ace556de06bdaf7f859c5e4c2b83fb796edb1d
MD5 cb2204e9eb18c8bdbd0c34e31339e35a
SHA1 209086aee4c0c0410789316f800a2cbd40144d12
SHA512 cd04ef0a8ffc2986d1cc921c8ad82f3839d80697777a4d8a836f6a19ef07737ac4ec1280f6652bca72d7464b4533e5135446e972085b1af211adf9beaafc92b2
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBH:EF
TLSH
T1A5071EE795D32AC93D322CE122453815DC18D710915BA7ABF3A6E1F7AE0534A24DCEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
832	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
832	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4236	2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe
832	lsass.exe
832	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 832	4236	2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_cb2204e9eb18c8bdbd0c34e31339e35a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 31.1MB
SHA256 4dc8cbd02307b1b242590d34ac2b266e1e025dc7bf99f830c889d53b548f857a
MD5 cb242b5b3cbfa6db28d620db0971f513
SHA1 35062819df72adf175c05789789bde2c26090862
SHA512 a25683743c1dfce36152f0b8246e738ff1043b6930cdbddc06ae367a7501a872e8d0f9f5978667e23c3a119786aee2a58837786af2dfd7653db9d2d8de7ce247
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB7:Eh
TLSH
T12467C8E383A501CA7D7229B0319B2559CC108B1291A7FB5AB3B1D5D2E90530FB8EDBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 646192ef37ebfb3ccfe8424b9f0a22b00e2887bdb5778de199b1a528fbb99066
MD5 c9a63f6038fe91d8ce9fda70e7b4a551
SHA1 6e57b34b92dac7b95c88b5c6aaef48009adfec15
SHA512 21201df223e39fdce9c1e2eb9d1b155c8b753f06126e2f2d21fc91525252310d261d33cfffe29cfd0a7086eb5431a00a96726dcb69d474d806542b5cdc5fd062
TLSH
T17DB0120147A997621400B00B5DF2020D84313BDA3B0A2BA81740D64D288154DF885346
MD5 SHA1 SHA512 TLSH