921911283fb0ee19232ceefe7b1b6edbae7f6c6b1713042645ec1c10f6437d42

Analysis

max time kernel
150s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe
Size 15.4MB
Sample260511-sn192ads2v
SHA256 921911283fb0ee19232ceefe7b1b6edbae7f6c6b1713042645ec1c10f6437d42
MD5 3d9dc1593a4b62a535112bd9b5b64e4b
SHA1 b3cd3f1ec1063684e5aca63a7b4e30be5bd4e074
SHA512 871408f7872ff5617c979708b45b7445c7be96f051564bb12951345af558f62cdd2047a07f1cd93b4e31009486f63686685163001b90183e3e39174093c4150a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBK:E4
TLSH
T100F685F6EC90023F8581A231D1B93D41971AEAF7ED4600B0BC6A3BE43915BDA53D919F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5388	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5388	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2476	2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe
5388	lsass.exe
5388	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 5388	2476	2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_3d9dc1593a4b62a535112bd9b5b64e4b_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 28.6MB
SHA256 6f10f3a9c0dea2c98c8ed4797c677e12d629f5e5a0199030dce34f08fe58c9fc
MD5 414f0110d6910d8c59e37b87806d4d36
SHA1 447d76b476f6ba90bd27a0f3d72cc3443583bdd6
SHA512 42a8548a0d865b3b34d1fc4a69955829a23c70667aa1ebe7869a4feb58b3955cbef620c00a401837fca25becdcc7def802e921e9dfa4689fc208e36de21a4e03
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:Ed
TLSH
T19D67C8A0D8F183FB194BE132F1BA3C550275C8F76C958279EC585AD8560AFF713EA029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b2d3f27fea88d7d236904b8ca02925be8c63f6374bb5d995008e5e82aa2ee9a5
MD5 7bdcf3d43dc7d77a004c1f3376fbc942
SHA1 2c9aa035510f5d0570300f4eb75677504cce4f9a
SHA512 5956fe41d6fcf398d88dc51ec6dac4935c9b1b8601d336f4af27858ca66d26d0c205d815b98c7194c3639fff054b9f0e9fc798e71ca90bc5586716e3f34a1c67
TLSH
T193B01200767A57131941601327BD3A0D90713B156E495304F710C544A1C041CB85C202
MD5 SHA1 SHA512 TLSH