5445e0c72ff6efa9456c92aeaaa32acca343a6a7ec068d60019b73350226564a

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe
Size 14.7MB
Sample260601-tnz8eah13v
SHA256 5445e0c72ff6efa9456c92aeaaa32acca343a6a7ec068d60019b73350226564a
MD5 eaada2a51f5017672bf2ef6deb8f7352
SHA1 21c4621270a1839a87ef9ab4df31b3a72c714676
SHA512 3758b16b50e4a040763de68a5f90f8c66fea5a7abed3bb95339d21436e2ff245a08f8b028656c209c4be8a587cb9310b3c393854efa1208508c23d8cbfe3e545
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBy:Ek
TLSH
T1D3F622566763847F6DFB98250475B10FC82B30C17B1DB81AA7E78EB3660287F48A76C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3396	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3396	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared J\lsass.exe	2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6056	2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe
3396	lsass.exe
3396	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 3396	6056	2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_eaada2a51f5017672bf2ef6deb8f7352_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared J\lsass.exe
Size 26.6MB
SHA256 67ed5df5c56b2ec1c5f7abce7259ea1dfc39449b776284c85f82530f96997913
MD5 aac9deb66d93c2a6f2366863e60ca4e4
SHA1 2035ad4255fb8264893caf88760c1f89d23154cb
SHA512 83b270de6333cf6500bc6b307c15c9251e4ef1e69e8293179c0224bf4d2095cbfa3fa2047dd220126b4a9bc28c9f4cce2adf4151edca4551098de2095c5b30ac
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:EJ
TLSH
T18C57D70E9B5380AFBC539823405BB18F9123A4C0371A7D66FA655BF31947A2F8F25ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 692f8ec6dc61115e611803ea734e00201646731108c2afac5a3dd2e250c69442
MD5 1da4da1165da3886a75578359ad96459
SHA1 5c166b858aa3df39421c1f13f7e7d1698dbd0cf1
SHA512 a371ada97e35ee4beeeaca02eb1d86e798f117f46afcc74927b6823d8639b734d9267b82e6dc67ea0393dc29ade6bcb3d9a6dff65bd84a266b5b9bf9968cab57
TLSH
T18DB012C090B9D5172D0861374661990EC1112C0AAE6B37642B05F58663C284CF940141
MD5 SHA1 SHA512 TLSH