Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe
- Size 16.1MB
- Sample260802-av97eazzbs
- SHA256 acd767d56d8abecd40f83a63efcc9c783bbaa3de410993cca1025453757fc087
- MD5 69f9262d1c2abe1351a6826cb5e1295b
- SHA1 03a023f16c754e96f7497d9fb051919af48acee8
- SHA512 ba44811ca21a3870d261c7acdbe209f39d0c2eef1a0b720bd676aafe159ddf55aa4ed62835f179a6c69957e06bd16aad3831c48f59e4486afbf6e65759c8fea3
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBe:EY
- TLSH T1D20713F4F2BEA4B81F1671B6AC5FC32261FA8984A345732D6B84D537BF80401685EED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2780 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2780 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared I\lsass.exe 2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared I\lsass.exe 2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1424 2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe 2780 lsass.exe 2780 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2780 1424 2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_69f9262d1c2abe1351a6826cb5e1295b_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files\Common Files\Microsoft Shared I\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
- Size 28.0MB
- SHA256 58c79adc625409f6947276969fee03c91cb6986acc727ad6e9e355fde8115126
- MD5 c97340e3a3e93e55202146eed519532e
- SHA1 bf3d187c7071ee65cbb545fe7e5e6074d6b90ac4
- SHA512 5c5312b02415ecdedc79a17985b6360ecc23adf2caf7491323b11625f0225b28655fc5862f0a697e5232b117dac3485ae0322c6e030851137761a93edc40624f
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBN:EP
- TLSH T11457C779F9BD92381B7675BBDC67C39602F29864B202BF1E23C6E430BF45085244ED99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 f59ecfc2bff96d3323a58ed4ccf2e3483c582bfaeea8375c1275e470d53d52c4
- MD5 6ec8ea9b5825db2290e3d10e3a8c9914
- SHA1 5430771211cb781294736bb300debdce9007f169
- SHA512 daee6a0a03a6c00791bc35824c33a8a2ff59c8a3410a9c15a3df39b3f3dd7dc3dab7dfc67bc1c115c60a0b7e666c74973a57c8c1ee796fcfeb35affb81a4e6e4
- TLSH T11CB01200C2BFCA270488E01B9FE0314D90647C0DBF1E17449700980921C1E4DFCD0144
- MD5 SHA1 SHA512 TLSH