09066697430514d12e2053d879bd20b3277f88ab69a7039fed1b57113577e6c3

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
Size 13.5MB
Sample260528-aesbnadv2w
SHA256 09066697430514d12e2053d879bd20b3277f88ab69a7039fed1b57113577e6c3
MD5 5364a0da9988e7f117e030e7928cef4f
SHA1 5c7052cb1b7fbeb66180d9acb7d735ca85bd2bca
SHA512 bcdd3756d0e7d859a69f375010d46df4b27fcb07859bcfdf101c6d2d5a359322d27a5201ed4f4d554f60c62ea7db7ccff7616d0ac755926fb71e3219a5f694e6
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB2:E8
TLSH
T1B6E6DE25D593560BB2050EFD821E982D01FCCAD16519D74AA35FFAFC3B92AE4703D38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3056	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared X\lsass.exe	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2152	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
3056	lsass.exe
3056	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3056	2152	2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_5364a0da9988e7f117e030e7928cef4f_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
Size 28.4MB
SHA256 4fd17f14d0f600686074486610b4b55ac73cd3cd27bc3b1834b0c90732ae0da4
MD5 1761c49c1ed095743681f73f843c7dda
SHA1 9adec82a51c29fecd7c1ddbb5f9401b8a360c291
SHA512 a67bee16f9b25434d9e31576c8c99bbad4bb0347983061ca773205ecffd4825157d3395a4a014544c8f818c7e3cabb90d0b62a0a5b898b27b91480c812c505f8
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBO:E8
TLSH
T1B66796E1C869611AB71505F883AF57FF01F8D5D0051CD6E8B16F68D8ABC2788A0B8F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 10a3fa5f66eaf6851586a7e0bc56c67e334ce9a6fcaa7e39bce747e651fafcef
MD5 441a3addc87cb0e70fb2163a9bb38d19
SHA1 1368b5512e225f31d519580bbfd8596db26aa7f9
SHA512 1e66b6ce170381bd9865b28573a99005e933c44529e50c19ab1de8aae7dfee0da7038a2a935210e643a04b78bbc18e93d161389136cf4dd3282e345c0bd0a3d8
TLSH
T189B0121082FD89221001701706F05209B416390C3F5B2310C300D5057A8280DF680351
MD5 SHA1 SHA512 TLSH