3bd3799bc3d7cce04b70be47abc4520c109e59beca4c9980164250531a806634

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe
Size 17.9MB
Sample260528-app92sd15x
SHA256 3bd3799bc3d7cce04b70be47abc4520c109e59beca4c9980164250531a806634
MD5 980edda1e0b6afa91945bca8c0d81906
SHA1 8ffb45a9c69f68b9e53a0c8cd134f0c6e4b5806a
SHA512 65e283acd83218ef57d1bdaa649a129688952f1dfbe5dfa1a56078e997997b5ad0d13288c160f6639813adb359554699e731d8bd4bb6ed39da3ba1e2ae2e0354
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBU:Ei
TLSH
T1761796BEC0D6241F47B7EB2F330169A9578FDB6583F1BAC21E83B50D51563422B5AA30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3024	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1044	2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe
3024	lsass.exe
3024	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3024	1044	2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_980edda1e0b6afa91945bca8c0d81906_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 32.8MB
SHA256 76209213cc0a33822b9a8830bd36179b81627e6e5afdf11dc408320ebbb79ea7
MD5 656287a03c05ad22487f2b6e323aef45
SHA1 badc24fa2b188355b0b4f909f2bc9b3b0255a75c
SHA512 ba36717203a48de027084f0ed7426e94158217e6e4c936b69387d56b3c6e3baf9ff4cc99597322e5e54a055d20d52706fd0ca5739ec0ca30c77f86392b90e95a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBg:EC
TLSH
T19677C777C0F7295B137AE75B12125EBD28CBF36682D3EA874CC3A20D5016B912627772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 116103bbbee0eee3df71a231886772d758a3d4a12a9a40084e7dabf61f0848a8
MD5 1df1c97ade7356de9f813b1d99ceb391
SHA1 10f1ed70f129925bb3cf556600631c181aed0747
SHA512 f915fc311c5f07c140bff2a0ac991333bf038bc1bbf1ce38c762159fa2b10de8c1caf909f172b4ac5e8c93507b9885959a63ee1f1cfde8668cfeede7b39080eb
TLSH
T1C0B01240C0BA5F9A2088F4833F725448D8563E041A5A13208B10C448D8C340CF9E1240
MD5 SHA1 SHA512 TLSH