8c6445ae65ea78958c44aee8beb6b17e577544f9e217e3db85336b69619d1527

Analysis

max time kernel
149s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe
Size 29.7MB
Sample260421-2md8jsds7l
SHA256 8c6445ae65ea78958c44aee8beb6b17e577544f9e217e3db85336b69619d1527
MD5 f9f4ba8ab2e4086187d67dbff6e61555
SHA1 36ec2ee5f7754d91546b549ed4030c92a6417621
SHA512 b079c0ce6565f1808a7d512381e225e71ed4801a29f075151d06edfc483beab7e83baad58869a79672163f2e5083124569a2e0af54e059ca983581b92682cef9
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBm:Eo
TLSH
T172678469EE2C12B9BA4EB04D72F3959B3FCF518E101D326D87790B1A68D31D1F84A583
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
8	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
8	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe	2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4292	2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe
8	lsass.exe
8	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 8	4292	2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_f9f4ba8ab2e4086187d67dbff6e61555_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
Size 44.8MB
SHA256 192a7f82311b9592542faaedfdf79a41475044b66259d72fa187a959ec8cde18
MD5 0117a98ba2c6d14c4cd46c25830764df
SHA1 055806c322a6d241a80d129de12aa988334eb88b
SHA512 af298dd5601eda0eb52801214c79f17fcffcd383cbba5ead1d2fd640968c58a43483e41ce3ea819c6a0e75d2ce3cb39638ef1c80baaf7559a7bae12834b38502
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBN:En
TLSH
T130A7DB79DA2C33EDF64FB10979B3469B36CE44462068792D83B9079A049B1A3FC4DD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 4b4daa507d39bbadf7ab0548469e330d784bac6bfb9dc9bc1708ac80a4df3768
MD5 b17c16828b0284c89afe29bb0b17752d
SHA1 f34d4af1fdae22ad9428151a07e45e1cb6f951a9
SHA512 add4a576625731149cc06cedbbeeb502ea7d06db7ee5d76a132443938c6cfa766c1b11ff9ab20fb3a7a7aaa8eceb359a610d8c791f0aa206546428f50fb38e5d
TLSH
T136B012C041BD46734908F01B0760808DC9D02C041AC67B428720C44D3692509FCD0180
MD5 SHA1 SHA512 TLSH