a1e46d62590f14f47d4dad6e47bb391b0659d391d611cf11486f5b22ad45598f

Analysis

max time kernel
149s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe
Size 30.9MB
Sample260601-be3casc17q
SHA256 a1e46d62590f14f47d4dad6e47bb391b0659d391d611cf11486f5b22ad45598f
MD5 5f975337b791dbf33df9acc6ca9dc7c3
SHA1 2c74ae15ba1837338b5916895015575f821973f6
SHA512 e5102ef08bc881bc804abb4d0da4d8ac8a1d342ae066c3688506593f2004fc74078ad485241d65b0a5c394eb71c394f38ff8799ebddcdb18fba602de4b0132bb
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN9:jS
TLSH
T15467C6AACFC4932E38A1395DFDAC544F7079C6BB8C3ACC19A3414EFC9C4466854F5A68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5532	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe	2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6072	5532	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1144	2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe
5532	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 5532	1144	2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f975337b791dbf33df9acc6ca9dc7c3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 432
    3⤵
    - Program crash
    PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5532 -ip 5532
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
Size 44.4MB
SHA256 1ac5083e74c90d738ac8e567baadee4e04881393951eea3d49c6d42399cc2c63
MD5 bf0e9fec2e694608f5d0d06b3e340822
SHA1 4e484b22358bbce2bd41bf4e106bf7dbc0ea1bf2
SHA512 3edd91535005f692794d00e040f13ee171bdb3c2999b8c3b1a6b34da6be1c532cde8976dc3b5e8f5cdf8c2d67bbe1ba46682ba2f7df765c3013f17226915e5cd
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNA:jp
TLSH
T197A71A99CFD9972F79A0360AEDAC550F31EC827F483E8C54B3415E98AC04EE8D4F5A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download