d7274623f08f638a2251bb9d2476a2116c662f7208f1872f004fd375bcc902e6

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe
Size 18.8MB
Sample260605-25e8kae161
SHA256 d7274623f08f638a2251bb9d2476a2116c662f7208f1872f004fd375bcc902e6
MD5 6e44899baf295e601d04fa8adc71342c
SHA1 776981b633f9a51dceb6bed2b7c5b0725d00f3a8
SHA512 b91535ffb01adec2dcac88039e94082257cd551971a7669f35efa148bc02f64f622cdc6ff6d70e7bc38531bd1e8d06940624a35ed59f9ac87121c371fe7d7ed6
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBP:EB
TLSH
T1AF1774B70DCA09B0AC207EB06579BF07012813C591AB7D6532D11BFC7E60AA9568F79F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3868	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3868	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2856	2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe
3868	lsass.exe
3868	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3868	2856	2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_6e44899baf295e601d04fa8adc71342c_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 33.7MB
SHA256 fc97e4623978bd2055834670692e306855d3d6cce70c2b28aa74fa6fe7872a1b
MD5 6f20c179c26d039787e0329a2f5fcaa6
SHA1 b3855a3589f77c5481eaea9bc8a621136cad0f3b
SHA512 16feaa8b4e52c94b6ec14dfaa43d3eefb80f21c3dd08020891e014e3fd178c3c348f0bf794e5f1bd22dd259774f08e1fd1269a53960896ca9054a9a6ea0aa8e5
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:E9
TLSH
T16C7796F7388318608C16BC65207CBF49A5E463C6816BB6D470D55BEC3B68D483EAB397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9cf34ff59cb0cd09d41fc5493381b763022b150ab0f1df6318286a70e02a3566
MD5 35575cfbd6212f7a157d6bb97a9b530b
SHA1 92652677c293d3a5e4cb6d2b5c166d7d234fc8b6
SHA512 c0e752a88db425351d569fdbb6612da3d3645099fb4535d478366e09a74e54c1c1e120cf951364225f92f7a46bb12674fbba258684e59dd5a0c16d3de7ba31a1
TLSH
T1B6B01200C17DA521104CB1076BE2975DC4743C041D2617444354CB4B54865DDB544540
MD5 SHA1 SHA512 TLSH