c8a79c3def6b11155c87e30e44342e6ee455dc5c658929543e03fa5f7fcfdb8c

Analysis

max time kernel
149s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe
Size 54.0MB
Sample260602-clx7labv3x
SHA256 c8a79c3def6b11155c87e30e44342e6ee455dc5c658929543e03fa5f7fcfdb8c
MD5 456b93c866900cb4617872e4f7cef690
SHA1 fde9e4b0e4734a5445627f162088579dc69edce0
SHA512 a003e470417daa9462f5e494c7e70b9efebd13d7f7a08d5ff7e327ee81d0dfe882ce929bc7d57d39adb5d045fc98e383a99946dc6f265d8db9dbd47fe07a77a8
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBG:Ew
TLSH
T1A5C7F8BD607D3B82853B4010F2D91F5CD513479A56CAEAAA56B33D73A2CD3E1B142E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5028	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
5028	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1448	2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe
5028	lsass.exe
5028	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 5028	1448	2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_456b93c866900cb4617872e4f7cef690_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 3408cbfad530aaaaeb0d1e6b9b3b18460dd96fea1e3d0f6b23593247c0d59368
MD5 25b93a3f65fd3f5106196c6dcd622414
SHA1 b43aae14755d52a078816f9708cf7abdd42d7abc
SHA512 dffea4880d1f595762a3d4a3009ee55d4c2598fae0928e7091f2c7ccbf6d512aed228731a5bfbb7fcd6ec74361e7f1b110c9c6fdb324f3a588f428e66ce52363
TLSH
T1E2B01200E1AA851615405D03AB61910D9494391C1B5B13054750948E5CC1C4CB944280
MD5 SHA1 SHA512 TLSH

Submit Download