ecb18db9a885710ac8e903e7103ded15639bdaab8174c17abf505a302e1372a0

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe
Size 27.6MB
Sample260602-ttt9caat2v
SHA256 ecb18db9a885710ac8e903e7103ded15639bdaab8174c17abf505a302e1372a0
MD5 243c9123055da7209edd1120ae3bda18
SHA1 8e115caf9ad58efbb355b9af063b2350b1c04a0d
SHA512 ebed7ce957712553fde214ddbdae90a3e2479ea9d45e9474fff9b689e8ba4780cc7b26629863bfa830e404c94aba512f84eb579bd81eea176b8a1027f267a782
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:Ev
TLSH
T1C15794E5072719841A4ADBF6FCB3981D499759698B07F084F32D04F84B19AB0EE6F24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
496	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
496	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared W\lsass.exe	2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
928	2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe
496	lsass.exe
496	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 496	928	2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_243c9123055da7209edd1120ae3bda18_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared W\lsass.exe
Size 41.5MB
SHA256 5f8d9f476db9de722493e93e6918389dafe70dca38726161fdcc3145292292e5
MD5 5e0cac84746cc91a2f27fa112310a067
SHA1 79d61f3c91d551ace6dbd540b97155b96d9772d2
SHA512 d538da3bf1d88b4b68c25d997259d00b5b039518012e4f624491fe96e4fc386df41f15f2755f1f7cf53edef06709ce0f4f2dc50ea1dfe083b729377f08610c9f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBo:EC
TLSH
T1C797DAE6CB3A1D981A4FC3E9DE668234849A8C69CB07B140F76E06E44609D71F97F14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 3368a60555deed1efc008223e8b0fea5160bd934468ab833b939df4c1f4dd638
MD5 6fefb5c9363077a67963d5d6cadaf63f
SHA1 e15b3c6be06932379035ba90e67f35ec1df313a6
SHA512 3acb5cd691f0a6b1cb665645f4e8abdae907a9e8bc9a8153a6cde9a76bdf38e62f948bb311005a15ec03052c3887f31f9b21116e21bd5f8d2552f9bb821ed40d
TLSH
T10CB0121040BD57291480B0177EA610CC8061BC081D1B13148711F89491C2649FBD4229
MD5 SHA1 SHA512 TLSH