d8006030029dc5c7a3942edb7ee1b423d0425eaf4943669ff1494f9da4c90e7a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
Size 25.2MB
Sample260516-3ph5ysd15m
SHA256 d8006030029dc5c7a3942edb7ee1b423d0425eaf4943669ff1494f9da4c90e7a
MD5 efce8cd95365e0bb9616e8d47efedc89
SHA1 14b94b6d8f8d225a735b9721cc7bee483e40a720
SHA512 323cc5e843fc8623512adb88f7cb949ec475cc4c0738e94e716a6e10b0ee5e14aa26b0c3fce025f0041b5ccb50c7805a3b318c3b8426351d33c68877895c53bc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:EZ
TLSH
T11647C8A2AB7E5931CBA1A83D2C4515413DFF2CC30B8F851054A9C637FADA5881D7EF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4840	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4840	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1244	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
4840	lsass.exe
4840	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 4840	1244	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
Size 39.8MB
SHA256 6ca63a1a6b268521a699137a3549f088257f0906c3b86638fcb687a22c11cc42
MD5 62661bd2cde69152c3f869171e60f07a
SHA1 970428f79214948fd6ac6866e45708f7f35775bb
SHA512 9a5a9c0a177a5d2b04cae13bc0d345820695eee21f478a504b01c26c568daad8b8a730357e04dad8bbd4e9be43f6cb3ade55612e97aecc57505534abe2a81ef9
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBo:Ey
TLSH
T133970933FF3F94304EB0947A5B419A8018F83E870B878495D788C67365FA9A41D7AD9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 c8c6fcd5eedf7627848a068501ecccf2f31a97a8a234e63f9d4fa48198d2bdde
MD5 83ac7bab1636edfa4514e058e49eca1b
SHA1 ca96b4ebc059292730c666188563c63611591609
SHA512 5bd956a43236adf975832c7148f7a1b1f750ccdeb186c903a4f84bf8169dca93a0b70f00452dc034de51e465ac5069206a2a30780df5ecadcd36a63665dcf8c3
TLSH
T1ADB01201407D8A265800F1334763954CF1692D455F1B2B98C3008E8C308840DF852101
MD5 SHA1 SHA512 TLSH