Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe
Resource
win11ltsc2024-20260630-en
6 signatures
150 seconds
General
- Target 2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe
- Size 16.8MB
- Sample260702-algthagv3k
- SHA256 d743b05a108f108c42c10001caab578d3154de63787de937d8dcd77a78d765e4
- MD5 3bdbd151c69cb19fb3d2fddf8ccb72e2
- SHA1 dff7e8e8495a80136cdc57eca47be671b67c70b5
- SHA512 7cb33694c117bee58d80723958581341181055e080b41a55e52cb213e1ab42e48b1dd5332495cdb365f8bc3793be0073ece8507d8fe828630696ac4b938a3fb7
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:EX
- TLSH T11E077314738B7D06F35F2FF06182AAA1D57109BBAEDB109DA3247134C09E8558B78EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2040 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2040 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared X\lsass.exe 2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared X\lsass.exe 2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 460 2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe 2040 lsass.exe 2040 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 460 wrote to memory of 2040 460 2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_3bdbd151c69cb19fb3d2fddf8ccb72e2_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Program Files\Common Files\Microsoft Shared X\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2040
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
- Size 28.6MB
- SHA256 0a184ede7a64f5a7b1b97bb9e5d135bbbc0dba9758aaf5959b57d932f779332c
- MD5 de731b7dc5da91f84ed8609a42426c1d
- SHA1 a568d93ed00a3919ca0be4f9bb1b97e9a0893010
- SHA512 e339da53ebe1d57726a9d67832607ddda54aaf2ed887f99138fa27bda4eb66f93b079acd82973da887b2eb5c9ecaab7857a558bd7ca93918f5f6d86b48742a77
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBo:Ee
- TLSH T14567A518B5477C02E25E1BD862C35561E6220BBF16EF2968DB217535D07BD22B23CFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 d3eaa6796b5bae0df93495b24f9680d4a97602fffac3844fb8451984f734744e
- MD5 cae5956d112a8f910780d693bfb73169
- SHA1 72dec9b51e4aec1693144e07b5eb3eeb7b877e96
- SHA512 4728f581dfd5347739772f7da37003781dd8dfa020e31ae2afcddf73cae3953e17173030b1b74634e8ce6763ff7b9aec3525d1f41b292e8a07d9a27b68b9af23
- TLSH T165B01200406E8D552088B4571AA0F0CECD91AD3C6A9627D05730854C12C080DFC74150
- MD5 SHA1 SHA512 TLSH