76f439d6991a2b18219e2dc1cf1018c60efc44161836d89b3d4306e423ecf485

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
Size 15.4MB
Sample261024-2pdd2afh76
SHA256 76f439d6991a2b18219e2dc1cf1018c60efc44161836d89b3d4306e423ecf485
MD5 06730236647c1aaf0bc73f2352f0cc25
SHA1 e11c51de0954e6b66e7266ed0bdb55e8422d13f8
SHA512 e2af60a42ba2beed60080c5f8210f4a11d1f593c8e36ace47ac3d9b0c001ed74def2de01eaf3d76c6d6449b48cd5cfe5bb2d71aef3a39e52ef5ec30f7d102535
SSDEEP 393216:z99999999999999999999999999999999999999999999999999999999999999x:J
TLSH
T15BF639B78469B6499D9B1A560770FE3CAB23493CAFA8274953FE9124304C4F3E2F7641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3204	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3204	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4784	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
3204	lsass.exe
3204	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3204	4784	2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_06730236647c1aaf0bc73f2352f0cc25_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 26.9MB
SHA256 4eba17a97e2964fafe994f6817e53755b263188e24786e90569451fc7d54d3f9
MD5 361604fb0361ae990076cbfc572e8d4e
SHA1 4b07831808ca81d589a2a7136cf0000650494238
SHA512 1077f36072ae2d84270a41f31cb3c32ee859a5a2075c901cb56e81bd79f05007a328926a913490f402dcda16ff4a2b259bc85235988ba3cf4bb57e5032e4ec4c
SSDEEP 393216:z99999999999999999999999999999999999999999999999999999999999999c:U
TLSH
T14F57C4B74758E5CAAACE2B618B70BE3D9B52643D6EA1371193B1C220306E07753F7760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 3fcba42f2adbbf88154f20a699c93ddf64185cfdb1e26b398499f5591d74e7d7
MD5 7ee0c8c811b5cf7ef6b3fe6dabaadca4
SHA1 b53d6fa74830b44afdf008b622b98b0650989aa2
SHA512 e9d32e2b210a330b5f434aa5a1d62c61199e66dccaff47e1b19defcbbef4844d20c9931a62c43d0cd207a7a20cd45a25b547d1959228b886974ffc2c8c8e9a3b
TLSH
T1E9B01200516A9A350141B507066E7048C0B438286A9917880704C50CA4C466EBC8A701
MD5 SHA1 SHA512 TLSH