6a422660e9d16496d25c757753cfdd56a1154547170b28c781ee377f00c2b9d2

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe
Size 29.6MB
Sample260930-rnns9shd98
SHA256 6a422660e9d16496d25c757753cfdd56a1154547170b28c781ee377f00c2b9d2
MD5 06294443e2707b89dd47b142c0f59e94
SHA1 8505e399122d909ba62a4f5c9d93e28a28103012
SHA512 285e27dc02f65af42868d33fed5d8be8917e21a1cda12f3f3f6b4c87b1a2a185ba82147cb3b0cd2f5274760b4b4cb99ea4308dc86c54f1eddee6115e5ccde48d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:Eq
TLSH
T15A6776D58E17FA9CCD042DFFE026A03497663B48D868A06F4BC8BE68312AC7FC5B5551
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5796	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5796	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5476	2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe
5796	lsass.exe
5796	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 5796	5476	2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_06294443e2707b89dd47b142c0f59e94_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
Size 41.7MB
SHA256 c0dd40f863c6a3e6fa551e574d9a6cea38da8aab087a29952cc69cc5414aba46
MD5 cd910934681ccc313a716a5b30940bd5
SHA1 d946ab6d6127bce58e2cfa8c9b3dd4635d7225fc
SHA512 e91bf518aa931e6f3e908ad90031f33f0737b0cf6472e3c7c3f7c0a64fd55255e557f2d13eeed4c56ce9214b1a3b6f1a78ccd4f7fd7e259cee0f952deb79c56d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBN:E3
TLSH
T169A7A7815B5BEA6DCC042CFAE026A53547367F58F47D20A66BC4AD6C363AC6FD1F1280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 2eaa965f740eaab90a901f462462aa137bca523050c1ef68d9dc605af402badc
MD5 0968b832b4c47188ea87c94ecfeb4000
SHA1 8b8340cfbfb01451ed94216cf5be84c3cc3641ad
SHA512 5f3985e6d5180ef4f1e823c5330a50e713c987d8a3232fed85aa7ca4682c57f6438e5af9170b0a3ed15d772e794314dbc6c36426190e497f739b84b4df4b3ac1
TLSH
T1B8B0120071AED5131040A41309A2174C88303E091B0D37140B10C805128098FF9D1F50
MD5 SHA1 SHA512 TLSH