Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
General
- Target 2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe
- Size 16.4MB
- Sample260803-txpg9svxev
- SHA256 46fbf5c0434208b69310ed0bca8682ee45dd771404b1837eb9d30bb5d535de9d
- MD5 f6acb23bff58e6b6fd9bc4361a70a2fe
- SHA1 7b74d403726a1bf3119cfcc4b027aada851d9f78
- SHA512 5f2f393720c6c47f3c19e861d3925f58b83ca2cfab68775f5170e468a9a878802878a70f786a1ec4f6b274c0294b3278012d2a7604b28c413db1e98fa69c51ef
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBq:E4
- TLSH T1F00733DDFF122F57C988DB1A4262772ABA484D7A999352BD044DFFC0F0B93772A90508
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3320 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3320 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared V\lsass.exe 2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared V\lsass.exe 2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4168 2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe 3320 lsass.exe 3320 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4168 wrote to memory of 3320 4168 2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f6acb23bff58e6b6fd9bc4361a70a2fe_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Program Files\Common Files\Microsoft Shared V\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3320
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared V\lsass.exe
- Size 29.4MB
- SHA256 ecdb6454fda36e50c1f47efe6ca101a25b480f019579dec8469cf9cab3f88526
- MD5 8f24c780066b856b1d03b1057c8edc59
- SHA1 d37833bf96bf554f3f0fa891d8929fb2f883e045
- SHA512 0c87685060b814c110062ef9ee294621227b9eb9ad530f6e2a8a9da470b7ad63f9702116fe03d6eda4b99bc6e2e52849f6a4b4a80b6de4ba50c8895299f07d8e
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBA:EO
- TLSH T16267D99ECB02160B9D59CE1D45723233EAE88BBF89D1171F010EFF90F069767AA5A50D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 e193ad7d268253fff7d6c912d591770ecdb66d5980e3cd32050853f233695ea2
- MD5 2286f0d7924b40463e44547a691d3c25
- SHA1 5064ed15e344361e2f9d9ef13a6ef988721e278c
- SHA512 8fc0341335370865e50f83cb56d42eba37c9c7f259668e96ae64dc1b877eabb273ed682c3a0ffd9afe0b5f5078393acebb0f45a2a7ae870f368f414041b03fdb
- TLSH T1E4B0125281FA4F37080090072A751008D0237806ADB723845700DC85A1C44ADF887740
- MD5 SHA1 SHA512 TLSH