Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe
- Size 27.7MB
- Sample260730-dnjmnayapd
- SHA256 7b255cc4b42a99ec8970e78da271ecbc9d179d2706591c4b32e00a7f6bded567
- MD5 9ac06cd6c3830d6b45b57482e2291802
- SHA1 8767a43b14ce3c6e7815a12ade911aa2c51fdcf1
- SHA512 d5d0c02604bf2d4c7bd067e21ac80d25f0f8f57d05a874c6a5d0320291f51a5c6fd4452584f584f4e321bd28ff0a4c734617fcfaa64bf29601a800150b22212b
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBJ:E/
- TLSH T1F157D63D30DFA4D8A5176F818B65E5329F15EE088ED92E8F5691023E13D9A270236F3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3488 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3488 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared V\lsass.exe 2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared V\lsass.exe 2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4700 2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe 3488 lsass.exe 3488 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3488 4700 2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_9ac06cd6c3830d6b45b57482e2291802_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Program Files\Common Files\Microsoft Shared V\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3488
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
- Size 41.9MB
- SHA256 a4e60edcffc8599322575cb927f0fe1c8ea01d6ae9d64a2a538499d3b43aff9a
- MD5 1ecc9bfd5cba046ae0256e8a684f694f
- SHA1 792ad3d92793b7a61ec518cba8e3a9d1df033879
- SHA512 d80bcf2386c7d96e1af5e677c2587de194f9f96029173e1dfaa2e7ef020dbba8d63cc31c79e262e069e0f3cffc8da8a8121dc203ed6bc68253f7bf85c0ccf2ca
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBb:E5
- TLSH T1F4A7EA7870DE9954792B6FC19A25F6726E2C8C698EF8199F5381023A11AC737011EF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 67873a98633f5c876fbe4042e580fb94489b45c5fb061687f6d1c58c2503b7c9
- MD5 d26121dbf2d5c26fd2e17a0ab1565451
- SHA1 2d68c6551b755da54c05d3ae1ca8ff9dd9ebec1a
- SHA512 eb1623be98f2af4c6e8ef3f05d21fbb2fe7aa4d574792b135ad6b7098bb2ed155da5d5284e66ff5269d465fabb82b196c19e96b6f74a6e6a34339bf8cc1907a7
- TLSH T134B01280C07A8DF32588501319E3485EC4B1A805596DA3145310E50556C5C4DB596104
- MD5 SHA1 SHA512 TLSH