9b60463b4f26417f0604808abee5fa9d25683436368866b531a58f03040dcead

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe
Size 19.1MB
Sample260523-dkngfaet7x
SHA256 9b60463b4f26417f0604808abee5fa9d25683436368866b531a58f03040dcead
MD5 907b3fe7d2c91617c48d5c1b7149ccbb
SHA1 43c8b1483ce05ca5e4cecc7a12bc1d47b86333d8
SHA512 1554ab32cf359613c06dc55fa8a47bbf4b1e49e3b9928a08afed13c695fc15c9b8423028e005f0814bba9d8c63315f0df168007820e2b52476def751ae8f6fbf
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:E2
TLSH
T1FE17A67737BFE3F0D7A231348FA783604CC43C3683E629569595C0A9865B45782BB2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1208	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1208	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared R\lsass.exe	2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3760	2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe
1208	lsass.exe
1208	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1208	3760	2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_907b3fe7d2c91617c48d5c1b7149ccbb_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
Size 31.0MB
SHA256 844d0323b2957a20b10554725b5f324e8996fa48c467f418385eeb4d6d3e8395
MD5 1caeed46944dbc210393838f2f7bb4a0
SHA1 00f946eb41afd856f068e3e5c21ed2a89bb0a8b4
SHA512 d970f3116e899572c631858d03b2a722f8ae051cee24143b4d8562c7a90c2e69529c10a71bc502690f9c33c99824222f914bd6196e9d60465cf36f53a6eb6381
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:E2
TLSH
T10C67A72333BF95F0DAE0231987A257E08CD8297283F4164B4191866D9D1747E61FBEAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 4825e6b7b04229a8597af3735ce3b77f95d2eaa46617eb7c2f6fdbe6da61ff97
MD5 eb9234c262d456389da5e1699e6a7d84
SHA1 651ca6cbfbf3087960bfab2a496a77fcbb29b2f2
SHA512 95abccc7dc6d094003ed0afd67b13ded2ee6a47c0a05131d4878866d4bfcbb268c16a05d522723403bb89a4da71c936ef73b665342a35d6239e0c72273c523a7
TLSH
T1EFB0120080BFC517008050175A6058698064BE0C2F4A17C44344E40964C0C98F8D61A4
MD5 SHA1 SHA512 TLSH