Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe
Resource
win11ltsc2024-20260706-en
6 signatures
150 seconds
General
- Target 2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe
- Size 30.9MB
- Sample260708-tw8vhsdw4s
- SHA256 50211728f5682e0c35e608575ab544eb3a507db95eec0aa021a3fc52687cdfbe
- MD5 f77fa464f8d6be05f93bc7daa6b6accf
- SHA1 d452b0decdd25ea52a0696195d51b24f9d27767a
- SHA512 da876d649b03e4783cc06d1a0fdbcf7a3d6428dcffaaa1222f194084bc12b558385cc31c8643ca26188c877c017149a290952c438829280cdf5315f5fe98f391
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBg:EC
- TLSH T1C067FB5997A34C31C823C572CD1E6745BB802B54A2864329CDBDDFBE424DE2728DB39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1908 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1908 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe 2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe 2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1500 2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe 1908 lsass.exe 1908 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1908 1500 2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_f77fa464f8d6be05f93bc7daa6b6accf_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1908
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
- Size 43.2MB
- SHA256 48760c39c5622d2723a36d6e4b32bb05a3e0132eb25b773b9f242b58c7f3e904
- MD5 1cb6cd0e19f9f957520026a4de0a4e9c
- SHA1 4cc54d4fb20de41597d3d25aaee14ab808afb48c
- SHA512 3e700634003bcea1580e90d7a90b51ee04d4f6747630fca9e8c8b97abcd6585a40c5f366a152045fafa88321580a72faa17d69e1dffcdd2f2e826b01eb2f2aed
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB7:E1
- TLSH T1E9A7D81557230A358812D1B7C50A2A02FF013B79598616199DFDDFAF0A0DE33B5AE3AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 dcd62daa6d436983785ef51c56ad6ebab2c3c42182456ffb87ffdb9cdb48b90f
- MD5 56a000ef6785ba8df9fe9e4a89ee6460
- SHA1 06404f79dd518a52e776b10efe70ce5b5ab1079b
- SHA512 30cb98049d257bac9ba7c00960102c1981382ed4050061100ad664f4532fc55154519beb335480de4b6fbe0e2f18fc6358f0c5975ce2ecfdc9a014f58347e652
- TLSH T149B01254C6B949BB194CD05307F1450ED16068082D7E238843109705E2C080EF450141
- MD5 SHA1 SHA512 TLSH