Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe
- Size 13.6MB
- Sample260723-b9vwpscn71
- SHA256 c4a2084f29b545db4b59a2d37731b4a7045da54127c3f1b4013a60a25c53329f
- MD5 57e8deb8df1c34b284a3c1426c80fad0
- SHA1 3c5d08c12462637c80c40f05575653aa325a97e9
- SHA512 a65aa324c32e73210c8d34b6172102ae2f02aa6e3815a56497a10fac542d257c026f51f99b740d5d18564fadbf7948c0fdc19b5ef6f565b98b1037d2b32aba27
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBr:EB
- TLSH T1E3E66464F4BD67B380324D5AC038437337989617E68B5EA40B1C075BEDE1A4EE3AE536
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4984 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 4984 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared G\lsass.exe 2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared G\lsass.exe 2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4916 2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe 4984 lsass.exe 4984 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4916 wrote to memory of 4984 4916 2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_57e8deb8df1c34b284a3c1426c80fad0_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files\Common Files\Microsoft Shared G\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4984
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
- Size 25.8MB
- SHA256 524aa8099239cb9a8b9c85ef8e5d08aad767da33721f8a07a63f73d5ad7e6a64
- MD5 eabfe11d872e51008322e29b04cc74b4
- SHA1 99b34cf856e70313bdc71dbac9621743282dea5e
- SHA512 1b1cd6ae304c4834bf3fdd95159d0aad506e020f85757b59636466020b6423c1da147e0bc6958b688fe77c420d9f2a75993090cfaa3dfb48c646b35e1a3130eb
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBC:EM
- TLSH T11E47D654F12AAA33C2220F15C4FEE7B6331C6316739B9D6209211DC7F59171AE3AD8B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 ac1c3260e45924c38c99a147d4305d9b4003c4f52e382ffa5556c74649fed086
- MD5 bad0b30f16470541d863090a67135738
- SHA1 987296b4164e464c6fe7cf37f3ecda2961a56285
- SHA512 38ae1dfabf0a399b6717cb1ab2c46c6f675e931187a767ba82ccc24504b191572fd36ab799d0a538e57455ea8d3aa6c960f4501e09f9378ef02df1a14cbbe766
- TLSH T14CB01200C1BED51E8400602359AA485EE166B9085F0637B40390D40611C1849F9E0380
- MD5 SHA1 SHA512 TLSH