4fa8aebb800c9507f8858ed9f29ade832851216e73f1ee79da3f462b0417a2dc

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
Size 31.9MB
Sample260506-1d16aaa16t
SHA256 4fa8aebb800c9507f8858ed9f29ade832851216e73f1ee79da3f462b0417a2dc
MD5 8f0f377ec644d7647560d527c4d8e1a5
SHA1 1437bf1b190390240b36fd73ca557031374837ad
SHA512 66aebd50c8c43800708d82a21eba433b95b96e356d8854c60dcf8372ef89124d28ec3eed2f77d8f138408c75d55ba26246146322013ac62ae7d24437f616f6cb
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:Eh
TLSH
T1FC77EBC0B7FA9CF11590418972AD601D5AF871EE1EF6A098B47760EFA48F367760C48B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1780	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared M\lsass.exe	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared M\lsass.exe	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3692	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
1780	lsass.exe
1780	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 1780	3692	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
Size 44.1MB
SHA256 591e9b63f7c6773eab5995a1f7ba85ed8c243ac46b02d06c7e754586a42c161a
MD5 f1586ba0067483c62a80222fb856f058
SHA1 30cbf6ba7e66793ed1e2eb45efe4e5169c3098b6
SHA512 99f980364222e7182f6821e62fee0e86ab5395b86e05956a5a9d8963c066e3111526fe70e8658318ec44bd355928a3c3b46ed989b6cb04a9b0ef5f408e289a13
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBg:EC
TLSH
T147A70B807BF9ACF08E905297B6ED711604D665F90EAAE1F8A133B1DF588D287F50C14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 61e7ba215926e03839bb440a3130f28d549df731b2fa57d68f56c2bc283c6fbb
MD5 f015f528caeaa8a427b823471492f7cf
SHA1 b538dba13e4e29cd1d8d4dc2dc10324ac6cb0875
SHA512 733b0d3813c9f0786bbf9ddb6b0a7da0935b400e0cb6b90fa40be1c6d134daa3a4a184acb52b9c53020821a71c0f323c081de5785802327f8acfbf2c437a0718
TLSH
T112B0120040A9C7260445F10F66B1A408C0D47C247E3513840350DD8450C444CF980141
MD5 SHA1 SHA512 TLSH