Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe
Resource
win11-20260513-en
6 signatures
150 seconds
General
- Target 2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe
- Size 14.1MB
- Sample260601-bpm1csaz3w
- SHA256 6d4824458985186232e55226e2f01614a063de7908493527d5de4beb813be765
- MD5 8aacc0192984a4bf2a64fa9d1bc4f43f
- SHA1 f09adca21b4c85a0e3f8dfaf0d81dfd2b6ad2876
- SHA512 b47fd0315bda58698403ee60ee19b4a12ef9a24c2231594de1f51bb6d6ed553e630287811d035e625afb73f57eee4ef8a0f95153ac569449633fdee17c7d879c
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBS:Ek
- TLSH T1A1E62995B0B91DDF36C43B7EE149163EC7C2A0B16AE368B6D0C475D43ACD211AAC5A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1084 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1084 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe 2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe 2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4204 2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe 1084 lsass.exe 1084 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4204 wrote to memory of 1084 4204 2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_8aacc0192984a4bf2a64fa9d1bc4f43f_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1084
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
- Size 29.1MB
- SHA256 828a3777081a8629bc5f0fb8a7f2b29cd768fba94ad96f66e83dac0c63437856
- MD5 649a0ea9fb6f35fbf13261415d80ea4e
- SHA1 6b29904daf3209ff682c69592278c634793055e2
- SHA512 dcbd892dfe3fc521a303b0df4e59a62d31477f31901f7a6e61079ca270a7e9e9afa97cce6b364d21d6bf8c541677664bf55e165c1083d3d281f8dacb8de9f5e4
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBP:E5
- TLSH T1A267724D2BB926AE6D44F6A934CF173DC7D3A07F39B2A875A01915D43B8B104F588A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 555441dbd81b64e13475db7972fe952562a2c21e8fb227478793407671c27f1b
- MD5 d4545f35abe0752716a0d6925a0ce07a
- SHA1 34dc76ef2aa632868ad259a4eafc5f1559d9cf8b
- SHA512 a3cca4e13cc938012bc7cad23ceb8d4bde9f024953030b011e975bee6dfcfcf076c6ecc0460fb8ec4acd1678a916fda100df208525638019a50bdbb7a4eba493
- TLSH T149B01204B07E7ED715545077A5A0214DD010BC046D6AD3043F009945948588CB9951C3
- MD5 SHA1 SHA512 TLSH