81278265fe4dfa4249760f591c163b4ecc8935e0e2dcbed690cdbeff137e9095

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe
Size 2.8MB
Sample261017-kn2a2acy3w
SHA256 81278265fe4dfa4249760f591c163b4ecc8935e0e2dcbed690cdbeff137e9095
MD5 b4426af770954b3c827923e77c4da2d5
SHA1 1c573163e02c44824e6d0f19e9d907210ffae419
SHA512 0ce00287b8260246322f812017352c6e613f35b1f368c43a6d37327c0581e7da8f027b17ae5c4fa4da8e8d04ac8f1662a9398549997f58701b3e31668baf4038
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:E0
TLSH
T118D5B30EA37B9B30FFAC437B113657B1D8900DB57E44A26D302D39D5D9A6F893A0CA25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2064	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2064	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared E\lsass.exe	2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared E\lsass.exe	2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4468	2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe
2064	lsass.exe
2064	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2064	4468	2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_b4426af770954b3c827923e77c4da2d5_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files\Common Files\Microsoft Shared E\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared E\lsass.exe
Size 15.2MB
SHA256 b662c7f2704e4d7c30737c7df079f25c55063efd4c4e9dff05c626e5251244fa
MD5 c14937ffd11a9ecd9e8b6e0aa681f6cd
SHA1 17243555885734bf31dd0a9e9827e4f944b507d0
SHA512 e12fff9307bee67da6953518ebda9a44a5e3d8d6c6832c24bbe739e8eea8e51e66488a9b002cb5bea2d8e6c5147648017456f08fae1b95c7a79799c5737c0d13
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBw:EG
TLSH
T1A2F6FFEC637F59CEFD635B2C40F61DC2DA3CC8871C19DDAA40442578B86B761B8998E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 e653e358607439c59e1353fa798726bfc2d3251b578b6cb996767de4256db480
MD5 b7d797af9f592522cffd384d4cb800c6
SHA1 e8f77e1dfb39a5af579a87306a9bf65120a19eaa
SHA512 bc337940cd1f587994769bbf1cc4b65de41cfbcb4646f6755f64e2c55229255529ba5e37c018b906a973dfc753612f474f305dd9ff9d37bdc7789245f3153383
TLSH
T106B01200A47ED611108074031EA1654D803468055F5663491710D9449585F4EBB88610
MD5 SHA1 SHA512 TLSH