Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe
- Size 31.5MB
- Sample260723-cdz18afb67
- SHA256 35a06f1768e45496832b4219d88092d1cc199501b6ff837e7fee90ab0815142a
- MD5 2217036e0b59a3bdaf27a27e56d089b2
- SHA1 6998f0676b736409bcca52f95f70d2579fa46817
- SHA512 1bb196a76f880715f976f55c4e75b97554970a85f45a2bbac221636df045ca7ff1fd35ca776c2c9f165384ba37b4a160fee6491c4c33364e86e86eb8b28ebae8
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBZ:Ez
- TLSH T10C77D62C11364FDDD5D66664FF044EBEF790A01EA558F4C6C6733B0CA6A704AACC4A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5956 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5956 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared O\lsass.exe 2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared O\lsass.exe 2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5396 2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe 5956 lsass.exe 5956 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5396 wrote to memory of 5956 5396 2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_2217036e0b59a3bdaf27a27e56d089b2_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Program Files\Common Files\Microsoft Shared O\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5956
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
- Size 44.8MB
- SHA256 6c11310d210eb1fafb8fc93bd9ed6b3340c1c3e48a9645f8b6c6e1565448aa7c
- MD5 836b6d7c487bffe9aae31e972da4f3d1
- SHA1 af2d44b2a7ad492fac6de9e4ae50b93e41c28a31
- SHA512 8073edde4eac18e2f3782d717f74fc8dd5882d1dcc8d84888f6f1ba64bc7936db0664b282e5013eea8caff8a5d99f1bc9648108443e41b2a427eb3ba85f453ee
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBi:Ek
- TLSH T126A7F81C546657DAD1C56568BE415EEDF384A0EF6800B8C1CFE3399CB9AB01AD8C9ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 b40c5658703ba71fd9f5d96f05a9db92b1b23abcc0617fa3527d1431e5020475
- MD5 99c41b7bee4baa11516eae701147b472
- SHA1 6608304c3ebce45da38135a8fb55c998bd925264
- SHA512 ef0e84dfa23ea21adf99059d49a5f6705a72ece0c436ea0f553db815a882f6a945f01d323a58ffcd602276e5e1d142c074a0ce949ce5d40587706f850e006e67
- TLSH T15DB0120C48FB46590490FD178D70418DC051BD0C2A6537910350CA091182C09F5D8100
- MD5 SHA1 SHA512 TLSH