af21dbd48d70314147b2f9ae145f19da5a4a68554dc30d6562a89411d5d867e6

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe
Size 18.5MB
Sample260601-blff4sds5j
SHA256 af21dbd48d70314147b2f9ae145f19da5a4a68554dc30d6562a89411d5d867e6
MD5 6cbc21f66788645ede99ad812ac81998
SHA1 20dcd6bfa58ca07de42d0e9f776f5d5d81194609
SHA512 764105b38db11b731ef11b7e0e6a0f34f56f54debfc8f857ff7b95cc611b455bf3421ebb68df272425355e136e2ae6973b7e25f23969e2682c67c518840a93e5
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNf:j6
TLSH
T183176490FB8B7D07D32788EB85EC75D661392704A08DCFEAFF9659928C0925984E4F31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	2872	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1520	2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe
2872	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2872	1520	2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_6cbc21f66788645ede99ad812ac81998_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 432
    3⤵
    - Program crash
    PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2872 -ip 2872
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 30.5MB
SHA256 cc9d55cb532cf36b681020ac6b6bcc9a87eaedf1a446485a9ecf9aabf3adeb2d
MD5 e47c55a05865d083cc19823e938ca24e
SHA1 4b0f1daf2d2386f8a18999b808efa382a429b9f5
SHA512 0ab7eb20de696aa6b3dab7856f8a0ebaee3f2eec59e597d73f933f552b91c307cdc454359eb55090f649b786e14540747933a013d6be4d922772d456e8cb3945
SSDEEP 12288:j4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNE:j/
TLSH
T12967E852F78A3D82D3B994EF48BD61D771673326748C9FAABEC548D34809A2181D8F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download