13f4cd563e29ef5e1b45af787f93b3833bbd938618a73e5d36ab53a5b7bf0e78

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
Size 15.2MB
Sample260425-dpbcnsdz2s
SHA256 13f4cd563e29ef5e1b45af787f93b3833bbd938618a73e5d36ab53a5b7bf0e78
MD5 c48bd51cc881ac5ef6b31dfc611f9281
SHA1 167235ada5d988aa18999249046eacbb27c029e1
SHA512 0b21cd907e5227df451ede400bb9d92840d6f2a6e1884275aee2d14761bba81bc8b9992bfa0358184795d6b7bd97f94ec1cd729e3b65a8aae2b15c5ec90b4598
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB9:EP
TLSH
T10EF63328817CFABF6085DD7442CE0148EAC53F51EEF2D0DD38D57AAB505C5A9AA0DEC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2108	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2108	lsass.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared U\lsass.exe	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4588	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
2108	lsass.exe
2108	lsass.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 2108	4588	2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_c48bd51cc881ac5ef6b31dfc611f9281_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
  1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Common Files\Microsoft Shared U\lsass.exe
Size 29.4MB
SHA256 6a1a70c507b0b6751174ef7ffecc1e94926a6c928d19d033c4c09f81f9a78eea
MD5 492e9cbe5a6aff43943ac1aedd9b19b4
SHA1 1416f188781ae5a0b521e168e88ba14a90d1cddb
SHA512 c785ac546b379d060e4bf2b77bea057004526875bcf3ddf251a16959f05d2cb70dd926fb64a976faba693c6fe390caa8e71644dfb6cee37ad8016459652259a0
SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:EA
TLSH
T11367D924DBBFE957606E85E003CF80DDDA613EC0AAD8D5CA2CE966FB418814FD607E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp_1

Path C:\SystemTemp_1
Size 95B
SHA256 9541d117e31dd742184eaa69886a8e50affef7eb1011c43377d646169d0ea2e9
MD5 a4742f1caab842c742561943aec51fdf
SHA1 dfe40d7a95d7487d66341f4a1c0516faf5e72971
SHA512 bfb4ab8f443af166c6ee576cfdd5e2e6a866ee0a6723a308a3c6121f386b44897b7dae49cafc2a398d0f7993fa3b05261924670c5c18c8ca2b5cb15e6bca337c
TLSH
T14CB0120081BD4E250404B12B2E761089A03C3CC81D572325A300CDC9519145DB590105
MD5 SHA1 SHA512 TLSH