Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe
- Size 18.2MB
- Sample260711-dr6lladt2x
- SHA256 68feff3dbd07a44b80a8721c0782fc39242a1cd033934e90029611b82658ba63
- MD5 05e4e523bc298c918219d1aa33ed32ba
- SHA1 b1cc0501a05535a76a4f23b187946c79ebe82f57
- SHA512 f3387ade1749898d5ad30c7edd3c7466fcaf2fce0e0215f4752510f27828d81598e58eee1680d1297a7e92670dc2b633e5f6ee04e402765149f6687ab8e19771
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBr:Ed
- TLSH T17C17518F1F65D5F2C14C6EEC1092E787AC73EBE238405919AC7B78C9514BDB0982E672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4804 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 4804 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared C\lsass.exe 2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared C\lsass.exe 2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3612 2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe 4804 lsass.exe 4804 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3612 wrote to memory of 4804 3612 2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_05e4e523bc298c918219d1aa33ed32ba_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Program Files\Common Files\Microsoft Shared C\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4804
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared C\lsass.exe
- Size 30.1MB
- SHA256 2dbeb1f798b57b3a64e3dc8f58e7abe8eb77c813165c55e88c114a4ec58b407c
- MD5 08ba196a29e98df0246e41c09f27f140
- SHA1 30e05a7100db69dcf09b932dfecb2a52f91d740e
- SHA512 844e3c782a8f303cd96186c6d2f019ca2dc764b76e2d9c746e6e2fb6e82ceadab9a5feecc4483f62546e2ce06b6f1edb9d6ee936b8ba22d469a5d7f15ebded23
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBs:E+
- TLSH T16367C99F0B709DF7E2C46AD88283E78254B5E7727D888D2889B77CEC21579B0741923D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 c0a38d99440edd691b41932bd67ce5a569e7026349a6b7a78b41349dc0bca82b
- MD5 4bba43aa857a6d2885547ca846a3e9ce
- SHA1 2d0aea51aeb77fdebfa5c55537472136ebf0a925
- SHA512 d1532c17ce6903d550ccf269c2bff7ed6663d9c2be0bedaf2c11270af657c3cfe7b0ebd4d13e4e89c2a0b6f9d782e3eb409a10f7683cdc900ca7dae0685688fc
- TLSH T1BEB01280526E8B392810E00359B1018AD0D0BC0CAA4A67540B10C64716C1999FC61A12
- MD5 SHA1 SHA512 TLSH