a3d167bbd5d75dbc98a3775093846672d41fa6ddfc0f92c7d0618dd51cc67393

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe
Size 20.5MB
Sample260608-3fca2sg16q
SHA256 a3d167bbd5d75dbc98a3775093846672d41fa6ddfc0f92c7d0618dd51cc67393
MD5 c17c77546b94c41081fc527c9bbc1d76
SHA1 cf76dee3de8cbfa9fcd389590acd8826f7d4fd3f
SHA512 642437e7c0ad5df4886b695a70d76df94e2ac58820234c9a83dc15cce21034888c529712d5de08aedb14721a39d42d65b4e04676150d01732a92d354a2088333
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBj:EV
TLSH
T1F6278800F9513D4909405DF659146DEE803AB054F3AB98F2BF261BF668F29DB2A1337E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
916	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
916	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared M\lsass.exe	2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared M\lsass.exe	2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5544	2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe
916	lsass.exe
916	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 916	5544	2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_c17c77546b94c41081fc527c9bbc1d76_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
Size 35.3MB
SHA256 63a8e93acba0671e961ae9555db3a5cda9df992050c95ff52061d94850429854
MD5 cbb3917259b9ab97932b3eb25c9ac49f
SHA1 49aa2303efb234a6274a0c0035e333e6582de3b1
SHA512 207a0c9eaa0a3d648f3eb66bbdc4013f70aeb8948a596f0dd1f2611f9b9865fb2a8077a4b815c077e51d275bbd1954b5e3d76fec38e9cbb14dd1e69055e93d3f
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBm:Ew
TLSH
T19687DA047D877D8A14551DEE41613C76C01760B572E684F27C2B0BA6E8BAE9F2E133AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 0a45dbbc29e56c7178869fb5b70e8e8a87a5d25e504d99507f7af1dac1179531
MD5 035d90960fb227fc9098309fdde41748
SHA1 9594f82c9455340c157d04860116f9d51704f4bf
SHA512 546dfdb240380508a2d11586c4390916eb8173032c8c32cc067051cd35606195babec0776453be44337d13b2ba9ae4876a365561e0e4f0bab25db61fd78a4114
TLSH
T150B01244C1EADA597401928B99A0640DD4146D4A1E5E17108700D9955585E5CF5C5301
MD5 SHA1 SHA512 TLSH