Analysis
- max time kernel
149s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe
- Size 16.3MB
- Sample260710-df63zscv6j
- SHA256 b7bccbba723110f0f9c757272d2da3e76b7206b1415ad0b12abb9da916922485
- MD5 318f1874277fab4d684795432aac9c91
- SHA1 908c70cadb73617fb23d5e36a7635170fc3a939f
- SHA512 297517795347c868f93cb574987a026f40b458a0d22c6a67f3681c987f90457cdd9c55e830d90746a966537c4a62edee7d17c011dc0567f8f25c8c5857e11a7a
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBx:Ez
- TLSH T1FF0766406CF1EF49D53A5C680812484ADF6874F869BCBBB672F1C4C2EA5B243526B7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3884 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3884 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared L\lsass.exe 2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe File created C:\Program Files\Common Files\Microsoft Shared L\lsass.exe 2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2812 2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe 3884 lsass.exe 3884 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2812 wrote to memory of 3884 2812 2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_318f1874277fab4d684795432aac9c91_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files\Common Files\Microsoft Shared L\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3884
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared L\lsass.exe
- Size 28.3MB
- SHA256 c8ecbd8871641eaec6c61089f57bb824f4037230ad5a95d132966707d4a2a3b8
- MD5 0a0c7c14f04aecba5afa50b50f5d76f8
- SHA1 5ba28f1c6ccb2c85b22e4e9551e297e3e1343e2d
- SHA512 5b4e98974ba480a63724baa510f74020f00cfbaa03ce9f80ebee411bbe23f9e1deaec5fce24a74b8d1590d0683fe1515a0d630533f23238c2f2301bdff74a053
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBz:EV
- TLSH T1EA57D6507DF59F02982A4CDA1C15589E9A5434B89DF87A6E30E2CA82E53F3C322377DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 a909a6fdfe155461d858807488f2ced5c9da3ff39953e296313421b3e8616662
- MD5 416c191e4eaae204955b7d0d0b3f8319
- SHA1 3e02f0e442c108a1af8d0f727deb1b75f088f528
- SHA512 98a28207aaa9f15740aaf25c4d839b556f7106f71d13aff3308a2927c5c42bc83403a3da815998498ee2030eab1783fcfba19fb6ea38145d31927f6cb8740efa
- TLSH T123B01200D1BED91604D0A0071B665A0DE1A07C049E0B13088710BC483BC064BBD40141
- MD5 SHA1 SHA512 TLSH