1a6e0c75d0c7b11f2fc55c65510ab6d98a560843f5de4e0ff509ba57cd7dd428

Analysis

max time kernel
149s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe
Size 26.9MB
Sample260518-2vwgsshx3m
SHA256 1a6e0c75d0c7b11f2fc55c65510ab6d98a560843f5de4e0ff509ba57cd7dd428
MD5 ec3abb146b445e482dc86a028c9fd5c6
SHA1 d2c00d3a2b6d0b94c328871743b4dc90e3cf07b4
SHA512 f2cb5ceb52e71aa8a26605faf18dad4ca7b07fdc96ce1635d55bcf7aa2d41fc60f5d1f6be9e5cfcac7200622358bffe8e33f31b6169491d91d537a88c2904567
SSDEEP 49152:jBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFO:jG
TLSH
T18A57E83D60D58B3E006FD87C2779F93B1E84D81B05C09EA1FBB90A3D41F4A6A6E27855
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3112	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared B\lsass.exe	2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared B\lsass.exe	2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	3112	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3200	2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe
3112	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3112	3200	2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_ec3abb146b445e482dc86a028c9fd5c6_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 432
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3112 -ip 3112
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
Size 38.6MB
SHA256 518f623a5b764a9eaf46c2674bd806a2eede8fc9b8896daa45d4c92b537de949
MD5 651d3b290fe2ba182e5220855895575d
SHA1 da02c888f9351a7273efc5a1ae827b2022eda405
SHA512 de1ae016223431465b7c1fe7c63bb03f8f8840e765588f922bc4903c9bb52be245a8a56d6c58f1d5d5b975aa6ae71d3144c3750be6189e6137148ece88fabbf1
SSDEEP 49152:jBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB:jJ
TLSH
T11C9709B930C5CB3D415FE874236D66FA0A45EC260BC0D912B9B49E3D81F8BAC7F19895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download