Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
General
- Target 2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe
- Size 12.7MB
- Sample260630-mxv7gsds4t
- SHA256 656b3192b009f94969f8b0980f452b7aabac5ebbc671c49dcbff5078ec485583
- MD5 3a2d972c5fcb2688bf0f6e5fb4420556
- SHA1 8956bf969da4d64ef22ae3fdeccf3f0a83e13f6c
- SHA512 8bbd1f220441d7e214a0dc6ba8b911f6387649c6b0ecf14789ecaa40f79743fe3222976e7394838b749154a618307dc696e0102e01859f6ab5d7435b49a81474
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:E+
- TLSH T1BCD602B23436FBFA00710D4FD6BEADE5D9AC273F2845A172FE74A624415518B3A704CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5704 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5704 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6076 2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe 5704 lsass.exe 5704 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6076 wrote to memory of 5704 6076 2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_3a2d972c5fcb2688bf0f6e5fb4420556_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Program Files\Common Files\Microsoft Shared A\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5704
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
- Size 25.0MB
- SHA256 b1eba276f3db1ac5e5f6555b6d5280c5b189c009a936250543eec0f5069b9efc
- MD5 4a5c9f0479b9ede65344cf4571f7dabd
- SHA1 5691598346ed7a91036b7fc860d0d0aaa6f73b25
- SHA512 4794c8050167a8d848d2e0bd0779876de2dc1be5f9e068d1f91e3439152a4dc65d4e7094bf1a1957586c7e63535b8e3a1a98a9ab10e66f1aabfb0094cfddefd9
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBH:EV
- TLSH T150478677F424F3F747A62A1F81B64DACCDF86E2E2A0952318E74DA24458608737713DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 d02e1741f49e0303832f9fc23662c6208a24496c0476ca4aa3670f79ccb8d492
- MD5 3996041eb765afcec6d96a2564c22ec5
- SHA1 cb1b85b499426e2bc77de7cd6c5965002b48de6f
- SHA512 fed59cc53ed0da23fa8503a53a206f3e8bb870eb6aecb0fbd1299b2818cc6a44e1104f26387fdb93c01041af026b2265b050e471c12a9fe00a5d261f5e37624f
- TLSH T1B7B012C041B98F250008940B9670184CD9202E64798F67914321A554B8D095CFD80105
- MD5 SHA1 SHA512 TLSH