22a9d569a43558a08acff5b8b719363c2d618386f4be96fe3dfc4a6f7d522254

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe
Size 20.7MB
Sample260528-cs7plsdx2q
SHA256 22a9d569a43558a08acff5b8b719363c2d618386f4be96fe3dfc4a6f7d522254
MD5 8d521069db15c47c201e5ba874e4312a
SHA1 735a17d2f20ef74812ac937b50d25297d1908a29
SHA512 da871bcaf7464a0d6ebbdf0aaf0c0580db8e85374097473bec8ffa45d4be861b170918b84f044ed1eea632724bfac3c7c51b89842aff0c5b01f201f20cf2bdb6
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBW:E8
TLSH
T1E5279806C10A6BA99D039B1198CE60FF52224D37218DB4ACD8AF6177F3B49C67B4B4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4896	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4896	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared T\lsass.exe	2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1264	2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe
4896	lsass.exe
4896	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4896	1264	2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_8d521069db15c47c201e5ba874e4312a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared T\lsass.exe
Size 35.9MB
SHA256 e21a43aa26a17ccf1768ebe5f0852132b21e3f765b5e74fb7c93103adffe73c9
MD5 1ea9db2a6b4a417c67b64ec19ed5987f
SHA1 b9f3f2de11758d6e2a1e778f8e63a5b5df2651dc
SHA512 5af2bbe137310583b2d73af059fbdbdef0979b76dc6874c6b613be9bf89b4dc1a1b2a81024bd69922a15ce15deacc7efe472d38431d938de03cb0254eedab2f6
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB5:EH
TLSH
T14D87DA4B62173BB9CA82C344D4D5809E45A50897310CA4C8E5B66A6EFBFCE8177CB4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9b050979567bc057456b018a9f3665eeb60e69644d92d6bae09a9d8474202989
MD5 d066f1d92598f688110b214d92c11ea1
SHA1 ca8a338bbf632ba51fdfce862dcdbaac8f8f5ac6
SHA512 a118d02323e2bf477f77d94c2934cc121d2c23e6e2812771d3c6d57452cc21f30c1f2be4608ac067aea3aee96f859271e829e79744b67d26521fbf51bea991d0
TLSH
T1EBB01210A1BEC51B004458474E70050D84507D846A06A3421738DE081C80858F9A4240
MD5 SHA1 SHA512 TLSH