Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 16:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe
Resource
win11ltsc2024-20260706-en
6 signatures
150 seconds
General
- Target 2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe
- Size 27.8MB
- Sample260708-tvb46act4k
- SHA256 7517bd0adecb941f8af7c0ec94c702b4fef803eb06a412e84a31a8977c86f0f5
- MD5 fa8dbc8afd69d62b2cdcb5ab29274f24
- SHA1 1cc74a13d7a9c3984fdd45626dbb3b55e9e2745e
- SHA512 720cd14bcc4985362e721cb85bab3fc5a2b72469b1876d9c854c3572a0109a8c9788f65afba8f4b02dbea1afff574acf8b4f9a4871828e5113a7687db64cd9ce
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:EF
- TLSH T14457757C4EE0836B92BD3CA4E49FEC8A572C17BF60434E4F6A04C659950B09956CBDCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1428 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1428 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared M\lsass.exe 2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe File created C:\Program Files\Common Files\Microsoft Shared M\lsass.exe 2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4184 2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe 1428 lsass.exe 1428 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4184 wrote to memory of 1428 4184 2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_fa8dbc8afd69d62b2cdcb5ab29274f24_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Program Files\Common Files\Microsoft Shared M\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1428
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
- Size 41.5MB
- SHA256 ecdbd0afe3ad11eaa1e97784e4b5a6645835ad6779f003c8a4b690d815d9f70e
- MD5 858ed5be8cb650d3de1cea433ae8a19a
- SHA1 fe626317efd6d365975c55f814bac2fcf4987ad1
- SHA512 5b2e4df16684d7ddd95800662ce064fe5c985d2871e23167fda67ec05158f70225772a80ad92cfaf7a5540d1e7cde134d70d90446fcfd67add2efad330ba6b99
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBz:EN
- TLSH T171971BBC059083EBE3BF78A6D45FB9C9022C4BAF60866F47B50846DDB00B66455C6DCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 891b2039ddc9bce27de69c52d8aa897105034e48fa47b87205653e3d126a4f1d
- MD5 5699148301bd13cc09864dd9e0958031
- SHA1 5bcc6bbcdb9bb10065babbba80d261ff6ebc8482
- SHA512 f25674f39eec7403f0434949632647dbf5e1b3e38b7da0c978d90b8618c02a47ca82d3325300d76922951da78709cf66140937e954d3324effd2df9e86d09a55
- TLSH T162B0127084BDCB152040A1235563245DD161AD181D1913004751DECA5E8091AF490244
- MD5 SHA1 SHA512 TLSH