Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe
- Size 14.4MB
- Sample260802-ad1xeaak21
- SHA256 952e1d35b3e359dbb57b50458443b49ff9e2ac4c5f65c5202711f341a793645a
- MD5 a67e006de73ada39f23b67969df8af06
- SHA1 048eb8867474dcf0b4b8cfe3d2757296777cbb2b
- SHA512 805bb3230a069e530b1c3e9aa640339469c9acc9ef61a7e728a5176c8da2a1533a422d68db25bf5c8ee83f514a549f852cff0f0c6ee1779c15f325198c3656cb
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:Ep
- TLSH T1D9E60330FB1ED484D4FD46B3C7ACADDA8C8AECE34298901C855C3369925DFAE3519A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 6248 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 6248 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared C\lsass.exe 2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared C\lsass.exe 2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2764 2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe 6248 lsass.exe 6248 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2764 wrote to memory of 6248 2764 2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_a67e006de73ada39f23b67969df8af06_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files\Common Files\Microsoft Shared C\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6248
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared C\lsass.exe
- Size 27.8MB
- SHA256 7b3670ff5a214ba108462afaee72d971686484ba5639c7e2dd07e58716295205
- MD5 476a55fe0b0f072b717d571b4ad9e329
- SHA1 2237f79dd0add4604ed5f08b9b21cbf99b6c3303
- SHA512 289595403ffa0dbb40aa3cab804138fafffc1d20912cd2dbdeb369e4ccc4d3090fcca449dbf3777540602f2886d33a088f2db0bb55cad60f960cf324a6aaa004
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBE:Em
- TLSH T1E2579561F64ED4C447EAC2ABC7D54DEF4516F9EF029A802C5BAD2A08C2CCF6B645CE44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 a8cb429ec943a4f24d3332a2b949dc8eac38184aa55cd823a9089d11ba9f98e9
- MD5 90d6ad38ab53ec5529fa05e8ef2f5125
- SHA1 474378bbf4cd0b5e48f2ee0a7a4db0828b8ebf28
- SHA512 99d66018349371f9f3eddce85198076f1c884cc41be7ff0739d82bfcf8f0eefd558981b87376768c0da057da56c5348500eb9cfb5f7b45303aeba3a885a89a6c
- TLSH T120B01204D1EE45365809980B45A0980D90207909E91A17D8C728955554F094CBCA5901
- MD5 SHA1 SHA512 TLSH