fc18514cd08e72e163cd74468b7e1205304a544abb3c93c164343bc3908bb2ef

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe
Size 8.2MB
Sample260604-m3nplacz3x
SHA256 fc18514cd08e72e163cd74468b7e1205304a544abb3c93c164343bc3908bb2ef
MD5 2440a05c3eb084933f9d62a1a64f9ef8
SHA1 c5304f6be7b67738ecd66d99ea27a05ecf043e6b
SHA512 14655580cc7050127d81b68d62cf46e1ee4ad5e83a5d05c7dbf55939f6176039f8f9461af5a7470f81127ccc11b16181797cf89bd6461971ae340b735b9880c2
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:EF
TLSH
T1F7863D448811BB25B9A8D7F9893206EBF2585677E1342644A553341FA8CDE0FB1FE8CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4452	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4452	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1944	2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe
4452	lsass.exe
4452	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4452	1944	2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_2440a05c3eb084933f9d62a1a64f9ef8_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
Size 21.6MB
SHA256 b2744cae17a46680131a5eb4f4af75df7916c7647979c1108d7168174036a99b
MD5 acf96a21ee0121ea1daa71e43e56de02
SHA1 509751fa1947bb9bb86f9ee1e37e7a00796917b5
SHA512 35bfdb2bdf6bc7faab0b21356d9c5ea6ef6b37951dd9050b69594ebe153a25368f074684e13f9352aee79c1de9f12a7d7be2c5a7562432212c1a65761ed39f60
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6:Ek
TLSH
T13F37C7999B7176A12CB493A96D3222E1F01016F3B8A9B0A46067BC477CDCD1DF138DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 36913b0ff5fff17fc97147099aef6a6107b82e3614d67eb117a3a05361fa2502
MD5 05bf04c1fd7a9a6be31200bce9263162
SHA1 7079da7d69c73d12b7e645e85b03999c7ea7bb2a
SHA512 5695a82d2117da29badf8d09b29d7da61890c2257d178c91cd34c271b90802fc8bf633d8a8c477cdb701ae7f784a10613fa3bb29789d5157033dbe4cceb0d4fe
TLSH
T15EB01214C1ED5E2914F4601347F5101CD4B138381D263720DB30CDD5F9C094AFAD524A
MD5 SHA1 SHA512 TLSH