47ce19b43dc4f078e3400b0f8dfcbbf1834d17214d18dbf10a64cf80e0726ba1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe
Size 23.7MB
Sample260602-cmdjkscy6r
SHA256 47ce19b43dc4f078e3400b0f8dfcbbf1834d17214d18dbf10a64cf80e0726ba1
MD5 aa6f85d3bf2c71ee047cbdd4c51bd611
SHA1 c26f4192808b6575203da95a732aaed478c659af
SHA512 2bb1fe3716aa37833a6870525db64a81d6afe91cd97c8dcd80df16bc4ea1f1210f710dc16af4f9acaca702f42f9bb6bd7eece82c2f0784cda2f8119bf7b90f13
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:EM
TLSH
T12C47D92FC8780176B8713D7E677B8F16C5FF19D6AB6A7BBE889B404149D506C320B122
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4756	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4756	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4800	2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe
4756	lsass.exe
4756	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4756	4800	2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_aa6f85d3bf2c71ee047cbdd4c51bd611_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 37.4MB
SHA256 4c45152a37ca8117fc0d7299763f6be375d0af77a33ee6a4534f7d924a57f138
MD5 613c6a10b41ea3c89ecae9bace058022
SHA1 a6a9a114b32be1ef54455f614866431cdcd09c5a
SHA512 78fdc43738e626dc7212d7cccaf74f91074f7ff366512e08f27deb95899f2624fefe96a877e1b73e7b7294b8abb0b00f191e142a2f8a32454e8595f73eb2c994
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBd:Ej
TLSH
T13087181BD432913A5AA12DD6466F8A0EC1FB78D5DBB4DBBF443F04116ECE0B9B187920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 d82f6121649a74dcd96397d6d975838ca8df2496275cf5a57bbcfd1188cd038e
MD5 c7b3a4a451aca10347dc6c8fdd900c46
SHA1 0611029cfe41cab8a68dfcf9af20c1a8f929547f
SHA512 8f1636810fa002a6ec58d2151892189b7657db6404b91a4a17cc729a1df139eeb0e1e8e212a160bb490ee1427dd63e23f737f55f912cf1c3af3251ebc7e7c73b
TLSH
T19DB01201E27DA5121480602359E624CDD4613C081E7A23001300894594D049DB944240
MD5 SHA1 SHA512 TLSH