c3b837346562e516599ade1317d91c4b21365dc0e7ed0efbb3d42fb2a4434498

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe
Size 30.5MB
Sample260602-cl1byscy5p
SHA256 c3b837346562e516599ade1317d91c4b21365dc0e7ed0efbb3d42fb2a4434498
MD5 a92a07e43e972c2d6a510457083278d3
SHA1 8f00134ece73f307099c8095b6ca844ac92bb5c3
SHA512 8d09530896bdc79375a5d19f9f459f7e74145c4fc2be2f92ca664050b3678932509dcc534f18a9adf02eb965b5e7daf7d88f3d1448d1b754c416c05595250ebf
SSDEEP 98304:Eqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkku:v
TLSH
T12967C6E14A9847C7DE2BAAD659D498FA11221F2F5DD22670FA3839CC774AC0235C2DD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1932	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1932	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared P\lsass.exe	2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4456	2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe
1932	lsass.exe
1932	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1932	4456	2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a92a07e43e972c2d6a510457083278d3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared P\lsass.exe
Size 42.1MB
SHA256 348bb2085fc7654164eefbd87c0eb0fb51f12cd3a94ed1e303f568810a836dae
MD5 4db4cd74d485daedc9e7d745b1db4082
SHA1 369da2e1b3a939cbc73abd6873735b519040906d
SHA512 dea838010caf68d2087a9d84fc66c1a78a8172bbfb70989eedfaec4ca9d82168f648ae15512ff41fc04192ad1fe1c1ff367d02235cc2885f327cb599f73fc795
SSDEEP 98304:Eqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkl:S
TLSH
T193A7FBE159AC9783CE27A6960FD498FE252E1F5B8EE21370F73834C97206C0169C6D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9f1e9820a807364ae6f27beabb6f56171bde1b2bbd06ad5af542a42795f23500
MD5 4538fae2a76a6f8ebb029b034272f1dd
SHA1 7358924accd2efe6caf70e4b8283911f6519e099
SHA512 3041a9df37efa94c24c175e12ca71fbae9b13d2eaf194a6a427473312e6aa209a048e12ea0579422d1c21e084c50613ae7f591097cac35af9bb90552d17ac38a
TLSH
T114B01214C1A9D51714049003D9F3228DC823FC0C7A5E1700131099C8D4C1C8CFB62140
MD5 SHA1 SHA512 TLSH