0e25bd9da00c96224a703d73ac8d4788eef103212328eae9cf2c07ae12939bbd

Analysis

max time kernel
149s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe
Size 4.8MB
Sample260507-ll7kpsev7p
SHA256 0e25bd9da00c96224a703d73ac8d4788eef103212328eae9cf2c07ae12939bbd
MD5 17daa17e1ba9b991156effa3a170d5ce
SHA1 e758aa9c66063972bc6e23fe50e641d61bc5a1dd
SHA512 2d4297563639f7fcc51af6b27cc3d17edb6b707db12bbc177a99758beb1a43d8227744c301cb5b27f79267172b73525a98f317b96571953dd4f41b116d2da2fe
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBP:E9
TLSH
T1D036A88955BF9F4DDC02E756086D2EE6DC7E14A53E1EF40AF46DAAC6780A02CC173CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5156	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5156	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3972	2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe
5156	lsass.exe
5156	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 5156	3972	2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_17daa17e1ba9b991156effa3a170d5ce_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 18.6MB
SHA256 c2d044e0cc46326e4f38feb94f2a9ea18a61f62303e7b95553a066db5848c00b
MD5 c36acc1f0ab87f748891c5834832457f
SHA1 a1d013d8f979441acbf56f3eb846babf827204e0
SHA512 3adc3fc0ea33bbf2c7c39deb72b99c9684b7763c34fa5aca2c9d4fbf528453fdcb810655e6133d7777eac796fe1b4ab28d7fcf56e5e36b530434086fff13a5a0
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB0:E6
TLSH
T1941753044800DC6C93B7BD428A96AD917EC9877CBBE57C78C61F19E1AEB051ADCD1B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 ff5e7d3ffa585e8211df2c5d7f472123f2749d8e1658af53ba244706233feb8e
MD5 26f62b71c5a0a32ca3b789a77e28c9bc
SHA1 741f86a6e9b9ab814f9183e9e9bce62ac8f6c74c
SHA512 d313ee7fe72911ad7eb484124f8e4c37ba071c6ffed8d13bea355fe3ee89c4f368b68c2c6a7fe9d32a97acaebeda01326712e80af68ac8606be6ad4117c5a825
TLSH
T142B01220C07B4B6A0310700756B0510DD06538041F3F179053118D08208295DB48D144
MD5 SHA1 SHA512 TLSH