8dcbd74b1aa9cad0fa88bf8e888d16f3b3d96aa1766653d7e4056cc6fb7d8e92

Analysis

max time kernel
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe
Size 18.4MB
Sample260602-b6q4cact8m
SHA256 8dcbd74b1aa9cad0fa88bf8e888d16f3b3d96aa1766653d7e4056cc6fb7d8e92
MD5 725d38e0f9d8c0f51f00299e6a516176
SHA1 cf3c2bd7466299d632c1d20744c7fd32992cf5ef
SHA512 d1782cfff264b435607ecb7369cf28169ced6c71e1fc6a32522f5c0266d44b7ddc0a3d8a7f2bcafb5a2fdccf131feb4d4ade0d813219e5be28c16e03ac2c275d
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB8:Em
TLSH
T17C17A841F043FB1D8F709338A92DFCDDDAE56A16198EE78014363199F2BD096E65E838
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4784	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4784	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2728	2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe
4784	lsass.exe
4784	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4784	2728	2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_725d38e0f9d8c0f51f00299e6a516176_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 31.7MB
SHA256 9614c5d93e59d3d5b0c2cdaedfe11af502b96fc4f756bb9baa0b147a2180a848
MD5 3aafc7ed85e9bef098d2037a5ae7b75a
SHA1 43ed87b9ac52d229326029ff25def5891ea0405b
SHA512 bfac55212f0c3674578cf12b77ae9960575bf97db6e5d66337107ae2926899c0a6ad51dcb5b8837531e47a53e31c57a2435f55f02c27a999b7a7c305bd4b6041
SSDEEP 49152:EwgggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggG:E0
TLSH
T1C277C7D1F8D7F62ACF64B1350E3E98D4C5C9BA5B2A8F958031393099E3B8061DA0F5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 19c2492a22b631a7838d304ccd4bfd21268e4fca32b852bf4e175f2251fe1c97
MD5 32dfbd791caf0b6c07d6e478f2b4366b
SHA1 fa5a7d7b757d0c162bc87f58b2767341bd224d10
SHA512 0ac80ff397245f44847901ecb54277f221a21b655580809467ff7100f23b026988b680c156a775785c8b0ecf43a0e95242da3e16f80176f23bf03d389b3cd9d0
TLSH
T11AB01220817AE6212807604F5DBA100D9092790C799B17408760D84AD49048CB980142
MD5 SHA1 SHA512 TLSH