d7c0767acef0a1c5ad86ec085ba0286e9d717f2eb185495676d3a03e52cbe6d7

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe
Size 14.1MB
Sample261017-e4ty1asw2j
SHA256 d7c0767acef0a1c5ad86ec085ba0286e9d717f2eb185495676d3a03e52cbe6d7
MD5 e455ec7be4fb02a45089a036fdc75aff
SHA1 479388f37950ba9dab482e220a9cb80d771d2ae1
SHA512 018e89f68d5fe94253b67be476694b6bb970121da53563b28be9baf36456a5a1e7f3da2c086811deabf7034a7809105b5298c06e94d4236e57d728966ce21884
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:E0
TLSH
T1CCE652FF596791083A199CD3103FDA37CD687540FBB77B0E8BC02A8AA90E113585B5B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2388	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2388	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3080	2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe
2388	lsass.exe
2388	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2388	3080	2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e455ec7be4fb02a45089a036fdc75aff_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 28.0MB
SHA256 b95a5e4157eb71665425829ec4471daf50d3bd2c8fbb1da4bb1e9a746c49975f
MD5 d1280531527b76fb1bbd55aef4245f25
SHA1 59d80bc87d740e648b2e97d92a5080a5a9de4e06
SHA512 7eeaec4b4878169071dc34ba3b8788328477bfb413b1e3aa98e06afc3aa804270e3dc82a579c8d8a0e3a40a6f373bf18f51f1b87b013f9ec63fb986d13cb8cdd
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:Eb
TLSH
T17B5795FE1A9F810C39199DE7D4BFC9528975B780BA7F2E4E8EC1B643580D06348436E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 411f04ef7c8c5a9f9add2b733577c7c4ebe979ec55c9224d9f91af6fbb36a471
MD5 4cc27f9562558dc641f1fdf99f2c7505
SHA1 790319e2d1fca54058c51a6a7abe99d7d3e4f074
SHA512 fccb3167e8c77aa60487d6c6c813453b0b58c2db2e75049e76a94415945494c52a7d1644061994824d867758581350ef805503ff6a5a24a74e1c1433189d4be0
TLSH
T112B0120040AD852720C460370B6595CA943169447F4A17DC5318EF0497D690EFC80541
MD5 SHA1 SHA512 TLSH