ac1c047099fe6fe99be9ad38b87348092f7ea588b66293beb9de8c67b459722b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe
Size 4.7MB
Sample261024-kw5nesgz2w
SHA256 ac1c047099fe6fe99be9ad38b87348092f7ea588b66293beb9de8c67b459722b
MD5 719d6a003837d2a8892bb5372218a685
SHA1 673ac261c721e736a0e769b77b43e37532d2825e
SHA512 f6bc8b34bc18bf1d45a47d8f6cc3aeadb63663b3d54f6e9cc0ea3d7c3187a3385efebc8d110ae276379b044e047eb671a21596794d16bba09f4ae60719d3b9c3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBO:Eg
TLSH
T1B7361AE8115A03FBD8C8D0B8F7601220DD078EAF95FE4368CE956B6AF2D4D1A1D5E1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2264	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2264	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4128	2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe
2264	lsass.exe
2264	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2264	4128	2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_719d6a003837d2a8892bb5372218a685_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 18.1MB
SHA256 7d64c0449b0e86b6ec8cb47ba6aa94bcdfaac226210d69d488456d4efa360d88
MD5 a64aa8e398fd36cd05ed541bb59f3248
SHA1 a91483273cf46744ed9696345051e24424eaefeb
SHA512 0881dae22289a56e329a854a40bcf00afc39439e83570ace83c488013a452bc9a20faa246d121837397b6f6779d527378273ca6c34051abfa3317fc839d8070c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBJ:EL
TLSH
T1F117342D064B8BADDED60174764FEB7D35864E5EB8A806F8D802381DB1D5BB73E01AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 f3a66fb5a30d9ce0d49e0933268125f234bca6a242803d491b8d0c445c0f2b25
MD5 b61795489dd29d9c81024357e3af26ef
SHA1 b8154c2008f453fcae63b69ef0a596f4da6467d5
SHA512 85c969ce7b96ee7268b057ba0f97da6a43b4fa820931679b5039a713b54868bea86e6622e715d0950245b4857a4d281c6847120aa83b5d10cf7662e7e1bcfbc2
TLSH
T154B01280C16B8E762041A01705A8E20E9071390879A7174C1B04C607B4CA40CB654343
MD5 SHA1 SHA512 TLSH