Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe
- Size 16.7MB
- Sample260723-b3b51sfa36
- SHA256 29a1f428866f250c2556c084684083fa81613ff050710d6d300cca693d93cd4b
- MD5 a2583dd1e3e794fd4ff9014d02712b3f
- SHA1 dd6fb1471691e243a3352386597699848085b31d
- SHA512 946f9620842ff1f80bd85bb23e64a27524518c14f53e259eeaccbae848d99b44aa5f4fe78fcc60646c7de6b9ccd8a4b32391d1ce5632c594ae0f0d3de9ddaba3
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBy:EE
- TLSH T1E007774AF21F6C5DE840C24C50549FAEC14238093F7729A37AA496F56742E7E712BFB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5588 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5588 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared O\lsass.exe 2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared O\lsass.exe 2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2668 2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe 5588 lsass.exe 5588 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2668 wrote to memory of 5588 2668 2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_a2583dd1e3e794fd4ff9014d02712b3f_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files\Common Files\Microsoft Shared O\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5588
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
- Size 31.1MB
- SHA256 0c33d6d690c26e6d9c8721d5b800cecef8cd14d20d85fb8a180f3c70ee6f8734
- MD5 bb650b2ed37e7b842ce3d2e7cc41828b
- SHA1 c69d80949560582d0a89889dd0c32b7d54049aff
- SHA512 87dc830045c11ba55eb70810e87cce98a371cff812e66417619aac1f8bd5d6e6bcd61d17761683c65c91a1f7da85367b49b24e5d92ffff4c09e153571312d8cc
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBZ:ED
- TLSH T17267C8A9F12978D7C940D29C431C1B3AC1A4104D2E7B64939F35D2B27AC2E5E61EEE73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 3c342e4570d50e3b54788fdd5bc76019906bcbca1523628958878899ba2b9f3d
- MD5 fb11a2b1fd2cef9bbe694becf6088c08
- SHA1 190fa767defef72b92b87ec64d89dd7c74b4863a
- SHA512 d91cb1f97f2a558cc490aba8ea554120b371b887b086a5687fcf1b49937a3c2e0acf1b3b93c471d9e9761a93c60df60f354766f6750808135d75001c24bccbf6
- TLSH T188B0121440FB66660014502B6970193AD462F90C2D2533500750894572C1D0EF694100
- MD5 SHA1 SHA512 TLSH