dea17ce0a5c2accf9bb43dd3ef6a701ed9e111047fe64a6e234d71c2f3cc33c9

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe
Size 16.0MB
Sample261023-b7c8wawsav
SHA256 dea17ce0a5c2accf9bb43dd3ef6a701ed9e111047fe64a6e234d71c2f3cc33c9
MD5 f69b0e72531b56ea42b17c2ad430f53c
SHA1 787cea56f18b9b2b81eb2ac3c71ed909260853c5
SHA512 bead75436748125c4f96c5684fa907a4fa6636b3b89f1ecb74051fdcd92ee5bdbc0c0e240f0243fad438e117bef9e688cc30c22a7c94a31608565030e8469442
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:E5
TLSH
T187F645D8DD043417FBF724602E9060F661D42928E9E0FCF98DC79839A3AF9A157193B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5936	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5936	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5372	2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe
5936	lsass.exe
5936	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 5936	5372	2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f69b0e72531b56ea42b17c2ad430f53c_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 29.9MB
SHA256 b45e59503599c65dcfeff0e8fa4cbdfbe888be6aac58eba0dfc8935d2fef83ac
MD5 b4e70c939e299ce2f3d758cc1aae3ce2
SHA1 fceec53c2167bbb2ea7823120c3b9388c1d2d1d7
SHA512 52442f787b7da6c226761be3f97723dbb2507ec7c410f1dfff74528afd4676dda78db5ffffcaa8233fdf901a914ee8bd653b0152833a430d504a4f6ffa7b77c2
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:Ej
TLSH
T15067C690DE04B049AFE753343DCB61E585F44538A6B178B90CC78C2D22ADDD6D3AA37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 4a1d73230d81dede3c614ea4945272eb1bc984010e0367247690c2275eb4b02b
MD5 c19733d51677a7b63f86b02cee854a98
SHA1 764bbcf1356862adaefd8ba4788430776d41898d
SHA512 324c719dbf614f4e7b556fc26aaa1d895e2599e8297158c57f9e23a6a281003b01bc541d8b6911718f4c36eb5de193f16c89e8ffb45401506d948ab30df56e14
TLSH
T184B012014379CA35000D612725701A0AD0706D257D0617F81300CDC821D6C4EB895100
MD5 SHA1 SHA512 TLSH