d6be7057501727a279688ebc4c45c30f6d7f8890a8fbf9597145dfd677b6ef99

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
Size 28.8MB
Sample260516-3bdnbady5m
SHA256 d6be7057501727a279688ebc4c45c30f6d7f8890a8fbf9597145dfd677b6ef99
MD5 9b91773ca38e025585e8d400314c4894
SHA1 91d8b49d3b019caeefbd32e2ebb3446e16efd7c6
SHA512 e6b6f68ebcf0a6ecaaf9bb822cce91841d76438377e52d5e5f35f74b3e176afeb8114415349ac2d94da104c426371b03a570a97cf092a13716ce1c7494ed8b58
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBL:ER
TLSH
T1C867E6AEF42BE15B83CE04BD60C8B5E1E96A1A59340C90E9CFC3B9371B78834E751756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5400	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5400	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1416	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
5400	lsass.exe
5400	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 5400	1416	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 43.1MB
SHA256 0ae044e9d687a0c41267912ab4cce7182809f240b7fecc379f3d975a13d6f074
MD5 ac7abb7ea4d0161725fba0cfbaeb77a2
SHA1 00965554e31a415152b41d8cb114c0e5315c5794
SHA512 dabb1ce8c55a444a0f777c7f9ec9d2065a01897e869eeb47a1a7cb4253525cbbdc644e3f8d2dde51710ba96312b8bf647df4b72f3abbddf59edcd9e30474f0fc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBK:EY
TLSH
T1E5A7F97E746BE11B83DD25ED908E7AB668773278740CE89ECFC3942E1A2713AD381541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b3a5aff1769800da4fa3566069989767de0843a58bdc0d58c09b6e6ef9269327
MD5 e1670565e5923978a1b24299cf9071e7
SHA1 cd57c7d8c7b314d05637f740a73fbd7b4134cf8f
SHA512 c1e46d469f8f12ba80fda1ecc312f4bef68f9d96c38366dacfd36128bb671c42d0fcc6f1a64b2535fdf5db72397a60ca0155d60f5bdb331a8b68c0a654328751
TLSH
T154B0124044BDDF270081603396B62D8890307D4D294713201300C80F1180829FC4C304
MD5 SHA1 SHA512 TLSH