Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
General
- Target 2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe
- Size 13.6MB
- Sample260802-bakxfs1dmd
- SHA256 31275aaf8fbee0c20b199aaa0863e4b7b2abcc6739f26057fa7295a0e7328b22
- MD5 3df7f5a04c8b8c722b8da3f9787ea956
- SHA1 be06405c63161aaba21c9f47b75b644d98e69521
- SHA512 81842a833e1c26bfac5f553a399b0b9399130875c07701c7ec4d5cb22c9382edff09af4ec38abb7d5389488c1ce09c369832daac539d387453ae74b67ef7092a
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB8:E6
- TLSH T1F9E61196A492082B2D47FCDCFF115B0BABA2D61E039C05BB70550BF95EC687D7BA9103
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5160 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5160 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5856 2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe 5160 lsass.exe 5160 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5856 wrote to memory of 5160 5856 2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3df7f5a04c8b8c722b8da3f9787ea956_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Program Files\Common Files\Microsoft Shared R\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5160
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
- Size 26.4MB
- SHA256 897143a690e5064e8335366eba52f54769ce3b25278a85edb182661a4b3ac665
- MD5 8bd4d4edf5234a541bfccf235b8baa31
- SHA1 f091d7ba38c6249886aee058f1627f1594e30e8f
- SHA512 29584f6823426bd6679b262237412ac78e62b0238475955907016f4b518d74d9315487f217b16f8b27d196341071c5c957f8b114ec51983e9a99984b0c7d4b1c
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBT:Ep
- TLSH T18557866A520A0C316D6AFBDDBF1B0E0FEFD7E20D875C01BAA45147D5068247EBB58782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 db8b476c1334d7366d3511f7fd143d5eb76ab88a6bbb2a30a98c73393d38e2b0
- MD5 f360c3147f4536f2c10a194d36c8e16e
- SHA1 14b08d9f363a292a13aa9f9409e10ca0e16d034e
- SHA512 51267c928253337d9c6b385dbe9f6601a5614c1b4ec2386deaa6c691d9f32a84fbafb3590795d93976cb1e3ca61bb3308bfc64dc532a6c6f91f9a435d7f6cd1f
- TLSH T16AB0120091AA8D2A0863A1075A60B00D8051BD086AD51324D761950990C445CBD80302
- MD5 SHA1 SHA512 TLSH