f8b8946300c19df3531e7d89ec4bb01c53cb09f4ef9e6c4bd0a651dcc81951a2

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe
Size 13.1MB
Sample261026-xff2cavx7k
SHA256 f8b8946300c19df3531e7d89ec4bb01c53cb09f4ef9e6c4bd0a651dcc81951a2
MD5 9b0708611ba95473c31888130630cc09
SHA1 f570404480427cf258802150084a56bcc375a392
SHA512 7b50c031cbdad2e4744d280c9079b0111a410f4db9f1e080eeef8d5b4d26ab584eee7729cbe707b86e4509e638c79a463ba7faa400c312093f8d0a0ddcdade1e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBH:E5
TLSH
T13ED664C550A3A7F28A4B86C2FE71CE9567A614F8341ECC2AF5704546BCDC6A7BF52C02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2064	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2064	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared H\lsass.exe	2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe
2064	lsass.exe
2064	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2064	2068	2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_9b0708611ba95473c31888130630cc09_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared H\lsass.exe
Size 28.3MB
SHA256 ee6dfed2056c70428a1ec2dd09fd4096889bfecf05557939c1039f3903962a6c
MD5 7cc0195c8e09914d56f424ca3e102caa
SHA1 b6a97f53e578feb96fb03490370ed4d9f776a16e
SHA512 8ad48d5b863d888895ef8c2d57b56c0b2e2f4ee7bef55899768184c868a31a9265f1a7bfe66f157b81f7884c07b0391dd3b277bc46e7b2c18e43def030bb4d6d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB0:Eq
TLSH
T1AF57B84151B140E39A775FD6FE30CD426A141478082EC56B3BBDCA888F94E9AFFE6D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 bde413b160bcde2d7d5b1e5b5331d2f23280db7f4c84747a3c6fd1af1fb90736
MD5 d0f5b9a893311cd7f7abd7c47f19bd11
SHA1 30e316e0e6f29eb2ca2211d526ab5d55101adf91
SHA512 8f5deb0e3160d1334503bc79aee001271a894f342068a8ee0572357f51c899ae367838b91590a7fc64332110a3c16b0045c0bc92f9076e98cbb7820b933ddfff
TLSH
T1E6B0120044FECA111980B0032D74109BE06058286D5A6398472CC9166BCC69CFE95241
MD5 SHA1 SHA512 TLSH