67ed667ac4f8b2c36a36be986812af270ee806dd87e437f409f07cfa0ec023d6

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe
Size 19.7MB
Sample261017-actfyaev7k
SHA256 67ed667ac4f8b2c36a36be986812af270ee806dd87e437f409f07cfa0ec023d6
MD5 069a6736a4a9d8e9d86c7b1ca06a9af0
SHA1 3e2d5a68c793dfe9c16330df4722271a472c1d70
SHA512 893e585496c199acd1e2de266dca923b3fd6e32f00941900b6483c4dc0349f6f7b3c0546a62bdeea87f8cd59473eb05139c4c296e0ca332a33e8ac56f92aca8b
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:EW
TLSH
T1C82798DB3237938D98C7E46B7C1143FF767933A95ABF4CA52AC70686421104E743ACA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2732	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2732	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared V\lsass.exe	2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2236	2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe
2732	lsass.exe
2732	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2732	2236	2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_069a6736a4a9d8e9d86c7b1ca06a9af0_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
Size 31.8MB
SHA256 f52888c856d81a52f7a61b1eba5c62b76c514162a2408f21e36a2ca49bd1c215
MD5 d9c7a9335316f87dc8cd5120fc7b0d99
SHA1 45d84b2f7dfab0b5c72b30a22a22311f5fc55420
SHA512 c5ab07437baef1ceb1ec5528862f796c232edf7495bca67d39ea1e7fa1a832bc875c89a3db0a78d0c16611712bc5828dea1b004cc24967fa997ca6131aa61d59
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBH:EF
TLSH
T18677F9D332A6934E8CC264EF7E7383FEB1B967A51A7D0CF1B68611C59548048A03DDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 caced4f031ea00f956859f135de86b2d0f71d40847ab5112397ff53d1bb233c8
MD5 fbb09e61160c73feb78cb9846d2f78a5
SHA1 86df8063c21b5db793fd67a58a1e80d203279e26
SHA512 453ce7381a2a26902e349b3a8fef7f00e3861c14459efee71f2622a695d505999362dd42e9d9a9436077f7d7b6527b7fbf50df6dff1659987b00f74b592e34f5
TLSH
T1DDB01244847B97953845611B47A6E80B907168165F4723CFD320C94921C9908F48A582
MD5 SHA1 SHA512 TLSH