76f439d6991a2b18219e2dc1cf1018c60efc44161836d89b3d4306e423ecf485

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
Size 15.4MB
Sample261024-2pdd2afh76
SHA256 76f439d6991a2b18219e2dc1cf1018c60efc44161836d89b3d4306e423ecf485
MD5 06730236647c1aaf0bc73f2352f0cc25
SHA1 e11c51de0954e6b66e7266ed0bdb55e8422d13f8
SHA512 e2af60a42ba2beed60080c5f8210f4a11d1f593c8e36ace47ac3d9b0c001ed74def2de01eaf3d76c6d6449b48cd5cfe5bb2d71aef3a39e52ef5ec30f7d102535
SSDEEP 393216:z99999999999999999999999999999999999999999999999999999999999999x:J
TLSH
T15BF639B78469B6499D9B1A560770FE3CAB23493CAFA8274953FE9124304C4F3E2F7641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5000	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5000	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4772	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
5000	lsass.exe
5000	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5000	4772	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 27.1MB
SHA256 9c0e574a74f0b61da13031be0cbd8e87379c3d37742b84371a5a051b44cf856e
MD5 f5ad87d3c8248d72b3a691ac4b55da02
SHA1 db4354ab469102bb56341f4dcecbdb9d072ae0ab
SHA512 a2568627aef7dd57dfd7ecabe39ef6bfef35066c9ebc08f05dc6c00116def40f0bfd1eef705dca56e2f28bdf5346549dd512dc37697a8af1b49a58faf2ad2718
SSDEEP 393216:z99999999999999999999999999999999999999999999999999999999999999j:7
TLSH
T1C857B6EF843AA1258F5BA6A607B0B1786D2745655EF1378BD3FB9929304807BD3F7200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 3fcba42f2adbbf88154f20a699c93ddf64185cfdb1e26b398499f5591d74e7d7
MD5 7ee0c8c811b5cf7ef6b3fe6dabaadca4
SHA1 b53d6fa74830b44afdf008b622b98b0650989aa2
SHA512 e9d32e2b210a330b5f434aa5a1d62c61199e66dccaff47e1b19defcbbef4844d20c9931a62c43d0cd207a7a20cd45a25b547d1959228b886974ffc2c8c8e9a3b
TLSH
T1E9B01200516A9A350141B507066E7048C0B438286A9917880704C50CA4C466EBC8A701
MD5 SHA1 SHA512 TLSH