4fa8aebb800c9507f8858ed9f29ade832851216e73f1ee79da3f462b0417a2dc

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
Size 31.9MB
Sample260506-1d16aaa16t
SHA256 4fa8aebb800c9507f8858ed9f29ade832851216e73f1ee79da3f462b0417a2dc
MD5 8f0f377ec644d7647560d527c4d8e1a5
SHA1 1437bf1b190390240b36fd73ca557031374837ad
SHA512 66aebd50c8c43800708d82a21eba433b95b96e356d8854c60dcf8372ef89124d28ec3eed2f77d8f138408c75d55ba26246146322013ac62ae7d24437f616f6cb
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:Eh
TLSH
T1FC77EBC0B7FA9CF11590418972AD601D5AF871EE1EF6A098B47760EFA48F367760C48B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4904	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1144	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
4904	lsass.exe
4904	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4904	1144	2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_8f0f377ec644d7647560d527c4d8e1a5_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
Size 45.4MB
SHA256 7f34bd9ecc662b190705dabe1885e395f40e6646139ceec1a99d6f3205bdae81
MD5 7d96aec38920ccd0e2385482c3085ebd
SHA1 d98a40955625453d915577c8a4c96fc831f578b9
SHA512 590b38321b5f636984274e463dc8d412f48d37eef3034f8d8e9b7c5f2360454068f4da2667d6623bda4ca1e444d79015148079420157a1880065db2440be0ca7
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:E6
TLSH
T1D1A70980B7EE5CF508405087B26A61099BF436DE7DBAA079E03790DF904FDEE634958B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 61e7ba215926e03839bb440a3130f28d549df731b2fa57d68f56c2bc283c6fbb
MD5 f015f528caeaa8a427b823471492f7cf
SHA1 b538dba13e4e29cd1d8d4dc2dc10324ac6cb0875
SHA512 733b0d3813c9f0786bbf9ddb6b0a7da0935b400e0cb6b90fa40be1c6d134daa3a4a184acb52b9c53020821a71c0f323c081de5785802327f8acfbf2c437a0718
TLSH
T112B0120040A9C7260445F10F66B1A408C0D47C247E3513840350DD8450C444CF980141
MD5 SHA1 SHA512 TLSH