618a4a435d92f163587a4a76f310c752d28a46670ed20001852aa94ba32ba65d

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe
Size 12.7MB
Sample260925-lbfdgach77
SHA256 618a4a435d92f163587a4a76f310c752d28a46670ed20001852aa94ba32ba65d
MD5 58d141198358ce6de99230492171dce1
SHA1 68c0987b7a470e78d1aa51514657a6672d263eba
SHA512 bc87968709f9301827a1004ba2970d410edb0cec5b905f956ee58e892044131f948f11c56512e970849cf040a58cb1fe370ed982a8db09b87fcff16f015b3ed3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBZ:Ez
TLSH
T15AD6235EFB86B606737DC970688EC3D176023A92B6491F64F5A236DC49C9F0F369D280
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5428	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5428	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4900	2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe
5428	lsass.exe
5428	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 5428	4900	2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_58d141198358ce6de99230492171dce1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 26.7MB
SHA256 04dfb1c2f73d1d2c749dd8de85696f300e1ec235dd6bc96a5412ce07079a9118
MD5 b55dee6c65e93d6c2c4eef683a356219
SHA1 f722e5d3c183af8c01ae6da533d0694a110bdfc1
SHA512 ed155173d3635fde4129904d85ce6e6e6212b6855fa67fe878f91fbe0c142218bdd287d513535644b14be14101ca3bc84e5298c728604b880d1a3583bcae4fbd
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBM:Ee
TLSH
T1185794BBE8C83B19F7AD88F555ADD3927300B5E1715D3630C18331ECA189E6FAA59780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 eaf23c39c2a5d9ad3a582339e818f4649ce3eb5fc953dc8b144bcbc57d78a169
MD5 7a5239780d5a4560609811057b3f8e50
SHA1 5edba2fe42e02cb334a7afdc5ea9361a4e1cebd6
SHA512 ec0af093eb5abaf4be305fddd6b4dbd7d6b9ac559555dbaeb8e17bb8401d131568cd962fde8b7379c863367a1d21e0b178b5c1ba92cea6276b8bb9412cbad6a8
TLSH
T131B0124086FD892A0044A11746A2824CD0B2BD0C1A0617100311DB04798140CFBC5620
MD5 SHA1 SHA512 TLSH