Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe
- Size 29.2MB
- Sample260719-2phzhsht71
- SHA256 6e365d8fc7f8297bfe3c56f21fc1edc8734bef99a0f994d26a88bf0fd08cc4ff
- MD5 4db4ac4764fc7e1d879ad2900bb45091
- SHA1 e5647d970db5b8a1483fd0f7ff049401e376c430
- SHA512 6c32efabb9b2936d47437ead77e2a00c91c44c444708d156b6993b0f11eca0c6fa23ed92636341c4ba46fff291a8b89dc3e591bfacb3a88b80619ed6a8cdc29b
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBG:EU
- TLSH T18C678642AC752737C1DB99766FC8891114206FEECEC243A85B1FE2D3D5BEB9428436C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5228 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5228 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared X\lsass.exe 2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe File created C:\Program Files\Common Files\Microsoft Shared X\lsass.exe 2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5508 2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe 5228 lsass.exe 5228 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5508 wrote to memory of 5228 5508 2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_4db4ac4764fc7e1d879ad2900bb45091_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Program Files\Common Files\Microsoft Shared X\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5228
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared X\lsass.exe
- Size 42.5MB
- SHA256 a06aef15901185f241740650586864de4210ad7bfd5408e551f325ec2e6688b6
- MD5 3c28655d46796bcd77b3acb32cd217e5
- SHA1 c1daaf987e24f46031084e20bd14f50e057a87c5
- SHA512 61e9fb2d24aa9fbe7681a68d30dd7d063a33dfe1d969303c328af54debce9c9e51fa8e4fdf8c4739abfc7966dfa3d977af59800740d465d0db2c893965fe4bff
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:Ev
- TLSH T17AA7D8002CAA9372C8D7E5B52AC5C5002414BEFE8FC242985B4FB2B7C5FEE546953ED9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 49dfc2a36aa4a819fb54ffac2334fd998b857552d93b9c85e1287402d6f2727b
- MD5 6e5e55fa4281f3afca50065c4f02284f
- SHA1 de5f1bc2df638ab40af13e962766404059d7a86c
- SHA512 9a6cc1a005123c6ee412506f20ce2c7009f9e95ef08be12c78afe790f946a8f75ed96721b6cfb957e9edce0360c460fa0b682ba343d2bd0170c0a66f0ee316f2
- TLSH T19BB0120090FD8E1A4004B833567A1508C0A17A481F1923560301D58C5AC084EFC4A109
- MD5 SHA1 SHA512 TLSH