Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe
- Size 2.5MB
- Sample260715-e8xwfsbx7k
- SHA256 9fbf293d5ca8aa2b9b85bc3838eb79a34c39ddf985f86dd0bdfe86faabc989d1
- MD5 8d022bd762c5511bfc167b583d4ca2b8
- SHA1 c53050f6d71d8c5cd92dff852de394a6a496b112
- SHA512 1f2aed0dcfcde34839c787fd9f43ea5a4a5f6f6099e2e69b380ec61603a4cfbdc5097f420539b3c1a14db1ce58ae34f42eda7abc3a21cf2d1e2e066f22bcf872
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBC:E0
- TLSH T126C5966871A97DEAE7DC856994CEE74804284F58E5BDE331E03429A18C3F68EF0D5E07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2908 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2908 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1760 2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe 2908 lsass.exe 2908 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2908 1760 2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8d022bd762c5511bfc167b583d4ca2b8_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files\Common Files\Microsoft Shared R\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
- Size 14.6MB
- SHA256 6d0c7cf949891e4dd598b783155bcf363f7f7d229c213db62545fa13b8f0d3ab
- MD5 f590fca694a9275a3589eb91098558c4
- SHA1 e9d42e3980a4fb13ee1f3363616d05b5328f8250
- SHA512 31ea776f62f9816612b2e4f19ddf17445cdf8647f9f049a40ac34fee5ebb17ede92711fded8ee93497a17345a31c0997e7ecff95a7c54da151d798dfec066c8c
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB1:Er
- TLSH T1FBF632753A2AF2B8CF7C882742341B3AB0B0CB65C504655976FEB44F9C785899337A9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 a81426c2b48d5ffb065f0ed5a79b5f37d83c7d5e9ae8077db05d705873a0b97f
- MD5 804ff892a21b0c3911de5620f69ca5a4
- SHA1 f141ecbb023c53c1b38897be588e50611a0e70a4
- SHA512 b886b73af9e1237971e6586d9fc4532b53c6b7116261b382c509ade9be27a4f04762b9da7c1f20ddb38a6e9f2e30833c7827e03751d797727d18eed3e857a6fc
- TLSH T1C5B0120142AA47211441900375ABCA09E0B1FD053D1E7B060721991616C040AB5D8140
- MD5 SHA1 SHA512 TLSH