09066697430514d12e2053d879bd20b3277f88ab69a7039fed1b57113577e6c3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
Size 13.5MB
Sample260528-aesbnadv2w
SHA256 09066697430514d12e2053d879bd20b3277f88ab69a7039fed1b57113577e6c3
MD5 5364a0da9988e7f117e030e7928cef4f
SHA1 5c7052cb1b7fbeb66180d9acb7d735ca85bd2bca
SHA512 bcdd3756d0e7d859a69f375010d46df4b27fcb07859bcfdf101c6d2d5a359322d27a5201ed4f4d554f60c62ea7db7ccff7616d0ac755926fb71e3219a5f694e6
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB2:E8
TLSH
T1B6E6DE25D593560BB2050EFD821E982D01FCCAD16519D74AA35FFAFC3B92AE4703D38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1364	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1364	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
892	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
1364	lsass.exe
1364	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1364	892	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 28.7MB
SHA256 b4209cb6eb714708cc11b6a9f736b746b5f7bbcf0460778ecc976c7326f3d3cd
MD5 b8c8eb2001a22dbdea10949afb1981c5
SHA1 fa8965e9cc74e276e0fbbcaa60769339897e4bc4
SHA512 d0b7406c4e86239977a55b8fb8ed8515ef8223737be660b8bbc3db661c00d30d810abe672c57365ea7e5e240e6ed6ffca48b4fff58929f65c9264054eca2f247
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBx:ET
TLSH
T156675278A153560BFB1804AEC13EA51C82E88DC92C1CDA1A937FEFDD3716B547219BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 10a3fa5f66eaf6851586a7e0bc56c67e334ce9a6fcaa7e39bce747e651fafcef
MD5 441a3addc87cb0e70fb2163a9bb38d19
SHA1 1368b5512e225f31d519580bbfd8596db26aa7f9
SHA512 1e66b6ce170381bd9865b28573a99005e933c44529e50c19ab1de8aae7dfee0da7038a2a935210e643a04b78bbc18e93d161389136cf4dd3282e345c0bd0a3d8
TLSH
T189B0121082FD89221001701706F05209B416390C3F5B2310C300D5057A8280DF680351
MD5 SHA1 SHA512 TLSH