33d26c17f62eb12b9540e813779792b5b9c6f6ddbcf62427f09b986533979262

Analysis

max time kernel
150s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe
Size 15.4MB
Sample260424-rcnn5acy2v
SHA256 33d26c17f62eb12b9540e813779792b5b9c6f6ddbcf62427f09b986533979262
MD5 c9ca70c19751b249415e986924103c64
SHA1 887e4d440a2dc1b585161e51d2467bde2bcc1b8a
SHA512 cab526b4a3440bc0255cec3a6067612e5bfc358e2a946b98e008fe873a7141898ad82b69d20449dd20fe6993d488ec1c88d655a787f9fc8b8fe065c0fa91403a
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:E2
TLSH
T1FCF623ADF689125BE4DEC5BBD29D7B12C6C588C490D6036632A93FD3E30C372D4A5DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4200	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
4200	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared I\lsass.exe	2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3932	2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe
4200	lsass.exe
4200	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4200	3932	2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_c9ca70c19751b249415e986924103c64_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
Size 27.3MB
SHA256 46552540760e11b0b9940d1eb80c022ad95f57e545c2b197d2ec54724c955c33
MD5 93131e760fcae5a857cc4d3279106e71
SHA1 5ddf1577a616a8ec6fb428666cd634d563cc2c85
SHA512 6ac050e2932f2a330ce5fd151a57f2541f446ba262fc103f2d34c1884f2a548224c420e7dd587e8fc40e8a8b1bce0949938f4ac3ea083feab7eafc5cd44272ff
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:Et
TLSH
T17E57966DF2886245A6A7DF6BC2D63A1AD19740C590D823E6371E3FF3C31C133C869999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 417e3ac4a43f321a607e47fc025f29b232c98a0c72558240c9d23684ae2064c8
MD5 ccd09efd42eba27a268070d7dc2c5e9b
SHA1 5540edb483d91548574bf1c2980bb46a6f18cc47
SHA512 de9c65d80457a908d440e82d1a43c7e718d4aa9f03d12ecab8e4a1d7ec87a13a7cd3f2cb78099dc6519e1c9502d38c32582569d134157e5a32a8f07538625129
TLSH
T141B0120041FFC955284850039AA2544AC172BD482B5623548702C585E98387DF9C1500
MD5 SHA1 SHA512 TLSH