4b624c602c73f129d310a93d660ee90924be27037150471098e9751dc1084e86

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe
Size 4.5MB
Sample260530-m8bbfsay2w
SHA256 4b624c602c73f129d310a93d660ee90924be27037150471098e9751dc1084e86
MD5 7ea511b9617514b0687419a56b502072
SHA1 c8562a749bd0d3a662841d580f06d823b48924cc
SHA512 806977ac9b58d70062405a83684af43ceeb2953bc87add51b3e4e7829e13a7511168fee9bcea2ee4100d2605a0303972633bdd45848e89984f8d2b9dfefa9cf4
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:Eh
TLSH
T1FC260BE28B2DFF0DE022C2785E7C349466D8234D7E8489F96144EDB58B3D04897EB5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4224	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4224	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
808	2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe
4224	lsass.exe
4224	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 4224	808	2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_7ea511b9617514b0687419a56b502072_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 18.9MB
SHA256 5f7d8d2b59139a7212d9179196d4fa94fe0daa9781b0a194602bb43e819d5523
MD5 7a178f2e2341ea427691760f976f50e0
SHA1 cc5c5f32607acd46d42b65a3b11575bd7b267671
SHA512 ffa0999f247f5c6bcb9cbfa61cef1dd0fc8f82ff4fa603ddb451cdea33f2a80cb66b28f19878b805cd38003ba22f6eb617da039ea74693a0380a1b5d81ccc0a1
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:Ec
TLSH
T1FC1754D1223C629AD431931D46B60C1D8EA7427CE9E365B064A372BBDF036961FE72D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 75a12659ef5b3f21bc997d541e04a03a2b17aad7a58370a7b849cb0863788031
MD5 4c7e3b5e5bb4d64fd8b955b9ce04d742
SHA1 ec9d7f0928ccb15a27888f3094aa7aba62e8a9d5
SHA512 ab5094cceeed3348af12a06233d837b309a27d9cd715899d425cd1acd0dc94a647a1a2aa917ff6b1e0e391565dd871364a0f1e2a33bbe57fc2ca018d545f1f96
TLSH
T1BEB0120080EB8916515470271775110CD5107E0C1B16230C2710D40461C596EBD5C140
MD5 SHA1 SHA512 TLSH