280eff53aa886ca6466569d6eb95caf9b956ccfb575800666d0ca3a8e215cd5e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe
Size 28.4MB
Sample260516-x2caaagy9v
SHA256 280eff53aa886ca6466569d6eb95caf9b956ccfb575800666d0ca3a8e215cd5e
MD5 e185ee7405338dc1837c940cf2309ad3
SHA1 e17cd2a23d4f5b76441949394a89a04bb490f4c7
SHA512 6e4c6037359c837fc5c0638e745649e153824b07e25f3f06a7d6e5e73b52dd84a0e12693d0d9f1616d8f414f1c06ca947c3abce74a43d16e56858cc9fe56aa92
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBz:E5
TLSH
T10F67B6A54B3A47680CE775F1972F96B2BB763C65A7D5FD092B480EA5CF335302222234
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1496	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1496	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2596	2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe
1496	lsass.exe
1496	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1496	2596	2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_e185ee7405338dc1837c940cf2309ad3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 41.2MB
SHA256 a301f8b653bf22ddad27b58985ad25dd3fc04a73a2110c3f9523009f32bcebf1
MD5 2bdee4a831f33fe86e82b7a48fbb214e
SHA1 3c6e1f5b050aa6cb3f2811ba92f800177af12bce
SHA512 d05ef0b8e316121079d63fed9a4b5d83c25f2b5ef871847d7a9e511cd9ba86877bd1cbe366904a8e745a0d11499cfcff02c7176279828f69883f99cbd1a8d4c4
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBV:Ev
TLSH
T1CD97E7A95B3777985CEB31E20B1F52B23B66BC2737C1F5096B089CD69B371252227234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 84e60de8b4a6de7b36de48d7d4fae3435377bc8d1c327a7f1fa31ec8e4111867
MD5 7cc1d61a734d6a2082ddae04e16f8366
SHA1 57b1ac87b34b0210f74d40fe2cb135eead716305
SHA512 36c13fa713eb8d9bffa2c2e9090b1c316327c4847529641ad8307b66de87b183c98e9bc686fec59cac10c49799d3c7fee82bdf52aff66f096402e6026b987270
TLSH
T11AB0122941BE471B1841B00F5E725A0E84746918AF47A7004700960912C058EFCC4115
MD5 SHA1 SHA512 TLSH