Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
Resource
win11ltsc2024-20260706-en
6 signatures
150 seconds
General
- Target 2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe
- Size 24.4MB
- Sample260709-ce9xtacw4x
- SHA256 f2ef32d3fe5dd375c22138f36f8ef899521a6ee86230e7115582a49a78900f5e
- MD5 9fc14e0f4f868b3428bd2b9cd1705f9a
- SHA1 a76b4fd08561a33fc44045cb3173c23bd2307db9
- SHA512 4459e58b9c57a6e9220ee2b9d5133b89f53a98468e5344f6232e1aea5b4f8a7872e855ebabb0eadf4121c42cd2a4d0378d7a08fb1ed03e24303835ac4dca5601
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBM:Eu
- TLSH T1704785CEC01D7720B927ACB37FE7E3E62545A3A186D612066F76C062B215145FB4B3B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1752 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1752 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared B\lsass.exe 2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared B\lsass.exe 2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 876 2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe 1752 lsass.exe 1752 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 876 wrote to memory of 1752 876 2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9fc14e0f4f868b3428bd2b9cd1705f9a_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files\Common Files\Microsoft Shared B\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1752
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared B\lsass.exe
- Size 38.4MB
- SHA256 68ffc95d380580d778ba17f5f758e218f2ed1c8134a0161e6f58b5eab7936a25
- MD5 1ad4eafd76752f9a851f95099ce6fb3d
- SHA1 ad2687fb5f65e9f95e0fdb37931fb9951895e32b
- SHA512 96e92fcc8812670542397559a63f8da5b9c68b5977b71e3cf46d8195286d0380f74b02026c7e31e8ec768d9cba13fc3dcca558714e5ad4616de38bde6739289a
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:ER
- TLSH T12997D9CED90E9652F41F1C72E7EAD395514377B283DA51082B34D09AB00E086BA6F7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 f75e367b75062db7196cbe03dfdb3d5a130608c3990684f47efe35a9df792200
- MD5 1e81f1d656dbe1731e5b38bef7194acf
- SHA1 a0bc5d38a96dbb8e76d41604674b1c99a5d29ef1
- SHA512 d97881c0465a10e1800ab448b2402f68654967f546b5df82689d2f2d98b7b736728ff78788354a7dc43398d9f298a290e2ecb45c5e2136e75a979d67d8c772d2
- TLSH T179B01200426A4A1A0184A00B5660B5CCC0A27A3C1D191B101301D7669FC095AFD40251
- MD5 SHA1 SHA512 TLSH