e58aff988ec3efe23ab2d02ff0d5fcc0287bb0cda5367619b131152f34bfb953

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe
Size 16.8MB
Sample260601-bb7slsc14l
SHA256 e58aff988ec3efe23ab2d02ff0d5fcc0287bb0cda5367619b131152f34bfb953
MD5 24eeee7cb0ded9d4d10a5dfe27d2d53f
SHA1 ec26ddbc11b79f6885a68ba7713bcf2fb53b58a2
SHA512 831a6147ed29318818a9ce7ebb04b87e6bd6313f08ac0b91844bcaf233caa3f8db8fb29bdee9b99df9aec316a494a6d38424b97cc25db949a9d9ce356443c61c
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:EC
TLSH
T1E8071412FB214BAC7E896B64C6BFE8D5DAA10F45C322351BB6C39DCDD013A097246673
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4248	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4248	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4948	2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe
4248	lsass.exe
4248	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4248	4948	2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_24eeee7cb0ded9d4d10a5dfe27d2d53f_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 28.3MB
SHA256 f7bb21971ba22442b2f0196684fef1d6fd6f6bde83e97727124b80d8128c1c80
MD5 0d86bc7ccbfb322d33129b75e77ab2ad
SHA1 daff98053620b19ea62ba817b44c7d008dfef427
SHA512 52127e0f416415a1e15fccd97247703b3c242e45b7014cb74d0e1478f9210136ae436f1734bdae0cb5a85c6842af88776ece4037d174bad6583769b4e60daa2a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBj:E9
TLSH
T1ED579526F97497F8BE9A22498632F1C5AAE41F25C312791BB6C3B9C5C03354C7981E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 05f80d26ba40558b55c9d078876589ea1c7f6c9db9b8af6e45494cad90bf68a5
MD5 275d557ef06068f4f5e836a8c9e31070
SHA1 9eebdf810ebb2f5771d5031c4c29f0d24c6e2136
SHA512 1dd784f7a44b6d151076c4402469019010d9d466c3ac922b0605632562f0f787d921801f65780a1307f113f94df49c94b3fc7f9e56c459076b69c7afb11fa5dd
TLSH
T1CFB0120080AB9EB1302562836671101DD850AF482E2723104B21F489FE8144EFD85149
MD5 SHA1 SHA512 TLSH