d6be7057501727a279688ebc4c45c30f6d7f8890a8fbf9597145dfd677b6ef99

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
Size 28.8MB
Sample260516-3bdnbady5m
SHA256 d6be7057501727a279688ebc4c45c30f6d7f8890a8fbf9597145dfd677b6ef99
MD5 9b91773ca38e025585e8d400314c4894
SHA1 91d8b49d3b019caeefbd32e2ebb3446e16efd7c6
SHA512 e6b6f68ebcf0a6ecaaf9bb822cce91841d76438377e52d5e5f35f74b3e176afeb8114415349ac2d94da104c426371b03a570a97cf092a13716ce1c7494ed8b58
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBL:ER
TLSH
T1C867E6AEF42BE15B83CE04BD60C8B5E1E96A1A59340C90E9CFC3B9371B78834E751756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4516	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
692	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
4516	lsass.exe
4516	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 4516	692	2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9b91773ca38e025585e8d400314c4894_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 41.5MB
SHA256 7caeeaa0da36f63a555c0515fdd7cac6bd1152d86039f7b024286375e0f7590d
MD5 11ff026fa7c944f16e2f6a7bfb0b805c
SHA1 d66fcf0f72bb547aa18cdd9df4a2366e22a937cf
SHA512 3ddedbb3e0001a12424457135ef561824dddf4b595c342100682ff3ad9c5456fb656cb4d08f9100eaf29bebc8e6b10b8ee813217f95d8de30291fbc61c731aea
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBC:Es
TLSH
T16397C8BDF873E54FC7DE18EC709D64E5B43A075C580C90A4CE82B83A2F2946AE553B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 b3a5aff1769800da4fa3566069989767de0843a58bdc0d58c09b6e6ef9269327
MD5 e1670565e5923978a1b24299cf9071e7
SHA1 cd57c7d8c7b314d05637f740a73fbd7b4134cf8f
SHA512 c1e46d469f8f12ba80fda1ecc312f4bef68f9d96c38366dacfd36128bb671c42d0fcc6f1a64b2535fdf5db72397a60ca0155d60f5bdb331a8b68c0a654328751
TLSH
T154B0124044BDDF270081603396B62D8890307D4D294713201300C80F1180829FC4C304
MD5 SHA1 SHA512 TLSH