5aecfdb01d18799bf892267b55b853f8f041e07be3a4c4030d6b05eb5a418a2f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe
Size 14.9MB
Sample260602-cwat2sby2x
SHA256 5aecfdb01d18799bf892267b55b853f8f041e07be3a4c4030d6b05eb5a418a2f
MD5 c5a96f429c302b265cadd8e30506a276
SHA1 22b75b67ea4a476f02b664f2619920a9654a60d3
SHA512 d64e1723611e4d567c06375e7f3087d0765be4be57858a0970ccdfcc4ef5dfca5f8193888e1053b7d88eb7e85381ca87b0b11cbf670f1415a74a5abdc500c1d3
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB:E3
TLSH
T11AF67263248CA716A4FA3DDCB22D1C3F55A52FB4DE0E286B07682346E953591CC14EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4092	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared A\lsass.exe	2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1128	2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe
4092	lsass.exe
4092	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4092	1128	2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_c5a96f429c302b265cadd8e30506a276_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
Size 29.7MB
SHA256 b85039b3c7b0c201ccbadb75cb451f1730c1770b216c0dae1a765a189c491c9b
MD5 77bf9815810fad80d30c091a0bd1576b
SHA1 e0eb8e2982ad9b23fd0acdec9876dbf4ed4dce14
SHA512 8198207de8c91a09fc2bc40369e5f3494b9b04280ccf6d65fa9c829d5faf83ffe53cb5f78f15c11a432df60e12aae388cb20f8e8af6e4aafac8d4bb96bbabc8a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:E1
TLSH
T13B67B726125CA0EAE4ED6FEDB3181C37585782B9EF145D730239A3CAE765D404E12CBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 09ce1d2334b1b1f85af272477bae8f8ac530722cf37c36dd11003900cd115412
MD5 b90f283187455900cf24a7be68baadc8
SHA1 7992007152fbfd8c26610960a3903c722240881d
SHA512 fb992f06d16c4984740cdc2f50804f3048fb77bc57f167b5a2568d51130bceb53ad855321c3be05ae915da0985eeb118e93a79143f108542c7a75c5c1e97844e
TLSH
T130B01210C0798F2334C2911346A0444D90E07D085D6A13041B1084CEA0C085CB5C2244
MD5 SHA1 SHA512 TLSH