bc06420f561dcfbb59b3c003bcf37e9967900da396f85a2d304939080548b8b0

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe
Size 17.2MB
Sample260503-1swt4shw21
SHA256 bc06420f561dcfbb59b3c003bcf37e9967900da396f85a2d304939080548b8b0
MD5 3cb4777fc41a48ce97593d08afb88cd9
SHA1 ed1af24dee2fb51d368a7b1bf7882cfca02599ca
SHA512 498a6025e62bf3a905288626016f1329d2105e754cd680dd88423a17958e42c43963e92be5356bce45eba5ccdbc35af0a4cc53d4ade707f0c8fad24e1ed6b95e
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBI:EC
TLSH
T15A0701BDF4EC2D44768BEB6259D09BE7B4A603C0F4799CE3F044095C24F1AC4A96E85E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5460	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5460	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared N\lsass.exe	2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4832	2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe
5460	lsass.exe
5460	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 5460	4832	2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_3cb4777fc41a48ce97593d08afb88cd9_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
Size 29.6MB
SHA256 2f203df94a5e5e77a9d2adb2700f7878faa2a80494e10b712ad3e9232d5ab660
MD5 6868bed8c29718219b25a7b372a5108e
SHA1 6d7f5437401940ce564e2bd24268b4cfb5f69e57
SHA512 4d2cdbc1269a9c9a38aea0376b67080341ee518c04fce44e84d90c53d714df914b9ca6bf87dd6be5e76e005aaee0399f66fcc05f803acfa7c845f49e4e09d812
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:Ep
TLSH
T17B67B9BEF6F86B166796DFC70ED1D7D374A643C5E0B6D8E6E140490C20B0AC8E96A40D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 8c79494b2f3aa134aed31b8bb9ccbfe53571caf21410b1522572fc18624a1ce8
MD5 69a0fcc408e9696b7e081e351f4fa685
SHA1 d8e8897d2016d566c76981799641974a941c24ff
SHA512 691000d1952c8cee02df0d9775784ef173ff736deac0eacc4cdcc32624299ce5fbb32ec3adfb591bb70c4882ba055f3e226b668d4e3a9cc96e041665232f01a1
TLSH
T197B01200457D4D17004598131B61505CA8703944DD9F679843A0D904D0D284DF690180
MD5 SHA1 SHA512 TLSH