3a3daea6edeb113f1b9e4d1e3233c4d88a599ff9525e12afece7962b0417bf03

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe
Size 17.2MB
Sample261023-bwcszaca69
SHA256 3a3daea6edeb113f1b9e4d1e3233c4d88a599ff9525e12afece7962b0417bf03
MD5 f7e8333c6ea018e017928cbe8abc95b3
SHA1 75548a3a88716c2ffcbfb70ef7bbac1891092785
SHA512 1688d09ebe95349dcad59db5595cc3986ffbff89f46bc9c4c757b5444c08f7f360eb97188a8b2f7c115ab2dc2de753f718af94ae14af0bc0ae05b18c7b33e16e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:Ev
TLSH
T1B50785FA23F10879B30577B4F78209B7CAD862CD5611EA3F41A1E5580D390AF7A293D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5924	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5924	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5792	2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe
5924	lsass.exe
5924	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 5924	5792	2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f7e8333c6ea018e017928cbe8abc95b3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 30.3MB
SHA256 ab9d2ca0a911f2af2a48b3d649f55c6be18c583e0bd36547c358da5b0d54ec1b
MD5 d7e1723e028f9636a20dc8b5d814dc79
SHA1 26bfc1bec9d21e1d3ccf516f28255c78ac29f871
SHA512 bfa04dabde449d99182c64c3d68874f058a86ac17882475722ff9f8e63b3d94a26064c21f57c940d99c5742d3444f236b2da0357d5f0f419c159ccbf17dbebcc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:EH
TLSH
T17267C8F453F14E52A300B271FB920AE7CB8904C90715A63AC173E90E5E2686FBE567D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 8955591aa82707659326cae8e47d482fbfd879d0bddcb2505856ffcccb2bbccc
MD5 3317ebe10ea5faf280fb3a604f4b6205
SHA1 7345e329a8c60d6e7aa5507c248109426cb32026
SHA512 9373fd39716f54d650349cee8c921e7ee222b9a7ad48880541d75d5441edd405a979aa6574facb8a1f5d32d9a0ecc323a885921677f79160b2c84c78a2160083
TLSH
T134B01200886D8A3A0014612F1EA14A8CC020291C1D051B844300C65827C0849B687242
MD5 SHA1 SHA512 TLSH