d8006030029dc5c7a3942edb7ee1b423d0425eaf4943669ff1494f9da4c90e7a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
Size 25.2MB
Sample260516-3ph5ysd15m
SHA256 d8006030029dc5c7a3942edb7ee1b423d0425eaf4943669ff1494f9da4c90e7a
MD5 efce8cd95365e0bb9616e8d47efedc89
SHA1 14b94b6d8f8d225a735b9721cc7bee483e40a720
SHA512 323cc5e843fc8623512adb88f7cb949ec475cc4c0738e94e716a6e10b0ee5e14aa26b0c3fce025f0041b5ccb50c7805a3b318c3b8426351d33c68877895c53bc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:EZ
TLSH
T11647C8A2AB7E5931CBA1A83D2C4515413DFF2CC30B8F851054A9C637FADA5881D7EF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4240	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4240	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4976	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
4240	lsass.exe
4240	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4240	4976	2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_efce8cd95365e0bb9616e8d47efedc89_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 38.6MB
SHA256 bdaf476247db6a1f9287b6449a797aa5ee318513b9350643badce9574e3a3d0b
MD5 cda969c211b8f108ace4b0df1e572b58
SHA1 8005011823064b3f2b20d3461fdf1b70cb8e9926
SHA512 c936569a298d9bf9a79cab9bb59df998c556e71e33a4d1afd3aa4e9d0c4b2590c766818394efa3b0945f3cd7f54d23b869c14d9b07bb0dbba2eeb3a8185687be
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBG:E8
TLSH
T13B970BF7FFBA6B729A73A43A24854C5534BB29411E8D804547AFC2B7B3D49480D3EE24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 c8c6fcd5eedf7627848a068501ecccf2f31a97a8a234e63f9d4fa48198d2bdde
MD5 83ac7bab1636edfa4514e058e49eca1b
SHA1 ca96b4ebc059292730c666188563c63611591609
SHA512 5bd956a43236adf975832c7148f7a1b1f750ccdeb186c903a4f84bf8169dca93a0b70f00452dc034de51e465ac5069206a2a30780df5ecadcd36a63665dcf8c3
TLSH
T1ADB01201407D8A265800F1334763954CF1692D455F1B2B98C3008E8C308840DF852101
MD5 SHA1 SHA512 TLSH