a6afbae69cea86f37d82b57c481816b03b241d794ba9a84e5556e40925339d6c

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe
Size 17.6MB
Sample260502-2f8htact6n
SHA256 a6afbae69cea86f37d82b57c481816b03b241d794ba9a84e5556e40925339d6c
MD5 1b0a1bd1184b31d273bac5fc51c47451
SHA1 f4c17c46c22cbf9330d73e23af9d18cc3394807d
SHA512 2b18c2f3efa2214cff099b76c0754e44ab51f5ca6d79ce750b54cfd1304eccb8399e276e2a82d7705bb8fbfaa24cc80ba27fd83228f6785631ec8d214fcdd43d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6:Ek
TLSH
T1BA07A978EE6632F7FC7A3711AC8738BDC22857035722856DDEE172C25D061229E6EC85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4252	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4252	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1692	2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe
4252	lsass.exe
4252	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 4252	1692	2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_1b0a1bd1184b31d273bac5fc51c47451_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
Size 30.5MB
SHA256 868f2c9c39a80d3a133ae8cc76ce2c398f9ad7331c8776e8c73a76fd65dc632a
MD5 3eed91dd74442f09b41acb757ad60929
SHA1 0e322e33bcc96f414c230997ddd2a9d693d75cc4
SHA512 7ac2260679ac1328e7196d32b42f4580dc426f6b7050676dbd4171f55793ad35a19ec5b6c8126e389bf2c14dcac1b11ec6accc9b49edb6932a392b8f540a3c05
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:Et
TLSH
T16A67EAF8EE1835F3D4781625F4927868E3DDEB0B4B62821CEBF45081CD6B26A9C9DC54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 f9d750312d8d9d81f820e734d94c3432b99b50a7849e25d174c21649a9bfd6a1
MD5 455b49311e27f0b136762c5dc536e8be
SHA1 f55b90a4d563551ab2eceabf9cf496783ddfc9a2
SHA512 fc3535bae63b1ce459c2a9a42a9e22e9f31fa8a565fa257b67c2be610325f6ff06f7c5c833add7ec2b129480be603522097c44086042c322474a352d099d4c91
TLSH
T1E2B0126451BE46370000700B4B6B110980513F049D1A37E56310840910D285EFC76104
MD5 SHA1 SHA512 TLSH