ed1141c94fccff346d4126caded83682e87d7fc37ff287fb49a0a3b9b7494893

Analysis

max time kernel
150s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe
Size 16.6MB
Sample260420-flt2qadv21
SHA256 ed1141c94fccff346d4126caded83682e87d7fc37ff287fb49a0a3b9b7494893
MD5 2e327e0da03c7a0845f0cddbdbd7e873
SHA1 d506c50b09bb7fc03d9f2bd4554b09e87fadabce
SHA512 e1a2b003e9c581a69449c3cd6675ac2dae3af4853f07f807147ef49414e67e75993e8c25377552844292d280bc629f13ff05aae031be58be05dde68293588434
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:EN
TLSH
T14A07A7C437DDAC841C083367AF960EA122EC8A5DD7916D566322334F21EC91DDBF6AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2328	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2328	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe
File created	C:\Program Files\Common Files\Microsoft Shared F\lsass.exe	2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4972	2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe
2328	lsass.exe
2328	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 2328	4972	2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_2e327e0da03c7a0845f0cddbdbd7e873_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared F\lsass.exe
Size 29.7MB
SHA256 37c8da1ca9a098f82ddb90808fa450e679fda546f3ce5806d1ec402f065dd662
MD5 6ec920b4fe6127cb7e1f40721fdf03b5
SHA1 ba3f783df059cd42c3cc1126d2f123590ca94bc3
SHA512 0578b1a168a584f5929a6969ac6db682aa984f217a49276c54084876737e0f89c7b0e883009f1e9a2e0f8f2413a6dd7479bb033d2d3b7863ee65d661247a0849
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBF:Ev
TLSH
T15A67938C676C5D848A2D63AFEE960D5232ED463CE3711C51853B734B21FEA1C81AC6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 2531f05e66742028e0d9a5eba9f66cea98d2a180b9dfe05b28d03226c2a430ef
MD5 f8cdca0480bdcd76bd1119f45e46ef7e
SHA1 406a1fbbdad350a2fbc275ed9142b1706ad863bc
SHA512 8e5996d70a1776f835ed40128f7f4e41163275bc441e7d9cab7c1083cd6b82f829661756bd13f8c4fc09cf2963a3b66a1acf30c598e332ee1c887753859c5b92
TLSH
T101B01210D0FA49691842D0238EE00A8C90123C4D6E8523144315C509E191458F599212
MD5 SHA1 SHA512 TLSH