Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe
- Size 31.9MB
- Sample260718-jawmyscs6j
- SHA256 f4802b9bd32cce3a4e9140987bd8581c4bb2b45bc04918376e539753b9773048
- MD5 7d3a2b67f6c181d75ead1c39a1c8d6bf
- SHA1 fbf5bc40e2049fa2ab9ee4ef94317bdb014f7bd4
- SHA512 8c27f43857d15575b4dd46da712a2fd47ba978dcf0754498acdebd6e5bc0100d42d39686336400f9c45a737b43520b6d20fcd1b7be003cfb584bf1f9464e8c53
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB:EX
- TLSH T1EC77C7FF80633DC1D9B1728BAC0839DB8AA6C9FB6179C4F57460051E2663460593BADF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2816 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2816 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5900 2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe 2816 lsass.exe 2816 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5900 wrote to memory of 2816 5900 2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_7d3a2b67f6c181d75ead1c39a1c8d6bf_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Program Files\Common Files\Microsoft Shared A\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
- Size 45.9MB
- SHA256 f97c20c8e28b9d7f5ffd9d6d2ec956d31a402d5c30ab3cb9092213ccf27e07e0
- MD5 17352d96c78b583443cb0f95b486497f
- SHA1 e350808bc1f6188a2d6f59b00b28b0f93414b84c
- SHA512 063d80b119b0dbb0bce6c4f4a6f18f2ff3ee6283ccc2fffb3b050ca9af3f5f2f39ebae932d98d653bf2319a4c6b0f77c6fe2ee68f0ddb9fb0081649c81858f93
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBo:EC
- TLSH T18AB7EBAF84A37EC0FE62A2C7EC44A4DA4B6195FBA03AC4E53810154D3E174D09D77ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 cfaaf614ca3eb81ca832221a0af80f188523f5a0f1df3482a2cd9e9c312192f8
- MD5 b6319c95dd76762e6e4c078767634ea1
- SHA1 58657bd04103fd84091652102ba0f517d31e388e
- SHA512 302916dcc362725851999f23392f7d5a4d63455d5420933cb5f6450ce37c974fc58bc75dc84886c649c19482cc46a80249767f5a809662457f21542e44aa4ee6
- TLSH T1AEB0124095FD45110C00601B05B1850AD054FB0B6DCF3B4C6B20D6CC528780EB9C0741
- MD5 SHA1 SHA512 TLSH