Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe
- Size 13.7MB
- Sample260710-c66pgadt7y
- SHA256 c590de442ff38e1cc971b36a6253236d19edab18b402006584ae28304ac8f482
- MD5 e45ce18e16453ff8f115f806315f286e
- SHA1 b467188df29f1be43a7ede8bef3b2100b0e4e6c2
- SHA512 2c21085a03e4a61090a53542889ada3a66e80fe2a67895e125a0ebb97ee4ebfe308c7c0205c798a69cfe500a17ef4586786132c958a4962e5c3e893bb1671872
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:Er
- TLSH T113E6146ABC4C22704CB746A893A5395109B7F3B1B39EF152D9C4FCBDA3E2D509912BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2328 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2328 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe 2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe 2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4368 2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe 2328 lsass.exe 2328 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4368 wrote to memory of 2328 4368 2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_e45ce18e16453ff8f115f806315f286e_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared Q\lsass.exe
- Size 28.0MB
- SHA256 f4fdf4e0e7c7a34a0cb2db692d0548b9d23d4a31e89227ceb616c3845ac8b36a
- MD5 77561ecfec0a0d50da6c3ccf20235261
- SHA1 69f06b7bfce73329f0a1a5a0db1e62b4de4933ee
- SHA512 d470d1d5c3341abbc8afce14cca90606e138a6e905ba7163a6ac0d640dd6e5441ff0ccc0bbd75b09f4e8d7e84795c1975fdaa6851b755660a20fcd23d6b40d0e
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBc:EC
- TLSH T13657A87EFC4A07304491457CB3A66ED2AF43F6B296AEF2D1C3C8F469A361D548135B82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 0d2579ba9b694d7f6a3c3bb5fe949fbce294659a9c49b9a4c7c8ce8722ca5048
- MD5 94dbd6b23e1932e4c1064880122fddf9
- SHA1 89067ca7b014f38698257bc0e141480a96bae7e6
- SHA512 794939f2a05f285240a276332e9526097a3138db61324377c5ec3ba59fca4c29d460efb6abde4d44988ab53216e5f7904daa6ca95d2cbc1d8824d10f226eeb15
- TLSH T17AB01200416F4A17205A510767B1D5DCE0516C442D66271007009D4423A544BFD81140
- MD5 SHA1 SHA512 TLSH