13f4cd563e29ef5e1b45af787f93b3833bbd938618a73e5d36ab53a5b7bf0e78

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
Size 15.2MB
Sample260425-dpbcnsdz2s
SHA256 13f4cd563e29ef5e1b45af787f93b3833bbd938618a73e5d36ab53a5b7bf0e78
MD5 c48bd51cc881ac5ef6b31dfc611f9281
SHA1 167235ada5d988aa18999249046eacbb27c029e1
SHA512 0b21cd907e5227df451ede400bb9d92840d6f2a6e1884275aee2d14761bba81bc8b9992bfa0358184795d6b7bd97f94ec1cd729e3b65a8aae2b15c5ec90b4598
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB9:EP
TLSH
T10EF63328817CFABF6085DD7442CE0148EAC53F51EEF2D0DD38D57AAB505C5A9AA0DEC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1300	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
1300	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared O\lsass.exe	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4392	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
1300	lsass.exe
1300	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1300	4392	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
Size 28.0MB
SHA256 dd3ddc1e101e92b99d28d2ee60c92148141cedd6d83a451b2917fbf38855fcec
MD5 88727c7ea01a9de0a0a5586fae146acf
SHA1 417add874f463729c1cb1926a45cf676fd17b1b5
SHA512 3a4f5451abd605bf21afdb12eeaf99fbd6804f9d8aad08553d1b149eb34946c7ab270b96e188f7be527d6480c985804cd1e1ffe981d2d077bcc2ba7e6ac3b775
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:E+
TLSH
T1205786780035BC3F10C7DAE88EE71405A9D97FF9AEF5A4CA34FE2AD74054A554809EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9541d117e31dd742184eaa69886a8e50affef7eb1011c43377d646169d0ea2e9
MD5 a4742f1caab842c742561943aec51fdf
SHA1 dfe40d7a95d7487d66341f4a1c0516faf5e72971
SHA512 bfb4ab8f443af166c6ee576cfdd5e2e6a866ee0a6723a308a3c6121f386b44897b7dae49cafc2a398d0f7993fa3b05261924670c5c18c8ca2b5cb15e6bca337c
TLSH
T14CB0120081BD4E250404B12B2E761089A03C3CC81D572325A300CDC9519145DB590105
MD5 SHA1 SHA512 TLSH