afcfe77c49db40cc5331697c7c158be56308606e491c8fd4bfc96292246c22d5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe
Size 18.7MB
Sample260531-bfebvsfx4z
SHA256 afcfe77c49db40cc5331697c7c158be56308606e491c8fd4bfc96292246c22d5
MD5 f404a14866bfecd1fbff2e55ea25b61c
SHA1 4831dac56adab3dce9e0ca5524b4f35ab93fb07f
SHA512 f5aa7e7e691c15ba97f4c8bb5a6fc209393a415632ee321512be1498ca4525d882baaf5d55b8d54a9918fc900326fb3e33d6e20873e5c54d68788ea085f89184
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBR:En
TLSH
T1B5177433DABD116043E3106436EB14A29BDD73D515A38E22DEB35EE3D4DA7AC60D13A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1208	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1208	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared S\lsass.exe	2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4896	2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe
1208	lsass.exe
1208	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1208	4896	2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_f404a14866bfecd1fbff2e55ea25b61c_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared S\lsass.exe
Size 33.3MB
SHA256 69939b763a5954a8443ad8b048e55343e44d549c911696469746c3fb758b64e5
MD5 4517f5d5ee3fab66063789b70d7a57b1
SHA1 7b1fcd845bc53f8a109ef898149d9e0a1724b922
SHA512 53d0e36addc21bfdd36f4ccfb46c31d8be5b21bbdac997d2100cca2f0713ff271a8e50853c64f4e3d690f17d450a30449e7de4dfd087f0fca41beeaa2045b3bc
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB0:Ey
TLSH
T10877C833ADF6495041F206783EEE18D1E79E639A9E4B9D008E677DB788C73AC548C271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 117b5519719191aaa32b10ed794b5d73ad9c34814fc7198b72d96c89bb697bb0
MD5 0b2227e90a06623fd177c925bd87de24
SHA1 5b65a9264312f801f4f3252eff8fb5f965dc0304
SHA512 e6ea74c13a2881f48c88d88086b06dd9582626db91d6acd5c7f1a5281344fbc50a978a27ebe28849593a5db9e48d8b99d404a44ce8c09eaa3c94048dd16b8476
TLSH
T184B01200897DCA371498B4430661904D81216C06DD3EA3504F30C647758186EFD48100
MD5 SHA1 SHA512 TLSH