Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe
- Size 12.7MB
- Sample260804-l6331scn4y
- SHA256 ad1a2017fde9604cac2448faaa07e1f16f3233033fffb24beaa8305a4b7bb04d
- MD5 b3c1744b45aa2ba2126ef575c1d919e2
- SHA1 8a3cbab5d5eb3a5a3071601ac9f513c30eaff03f
- SHA512 cd72b20bca1c376aaab722ef297a1cd6e3000afeab6447a5067425a0c1de7dd18502bfa34c5f7bfca2497907154b669397cb6afc2445268a6d4184a43d7324e9
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBG:Ek
- TLSH T1AED623EA1052EBBD85DAECA646007B1A90A5DEF954F30EB5F0994897F830D91F20CCD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3416 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3416 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared N\lsass.exe 2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared N\lsass.exe 2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2580 2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe 3416 lsass.exe 3416 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2580 wrote to memory of 3416 2580 2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b3c1744b45aa2ba2126ef575c1d919e2_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\Common Files\Microsoft Shared N\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3416
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
- Size 26.0MB
- SHA256 03ec3e2b22004fbb6bad947eeedb528af8c7b6f77e8c0d823692ca97f4086d8e
- MD5 1bc9eb815a8f90e8f4c8551e41207f92
- SHA1 5bcea85e63bd1906427d476a3f731ac0262af846
- SHA512 d6f50786e80154bb0750af27a7a1a4c4e7bbcaab13d07c2a789bf5aeee43a4122278c1041c6c2d40db8c74cf50aea76228a8a84b2a28cef10f4cb943eef517a5
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBH:El
- TLSH T1325798362061DAF959723C565B01E61231F2DEFB61A37FF6D049409B7CB1A08E24DCBA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 afcd5162c381d03f0b3d1cb15eccfc6135a21145f6ff0976f042af77f5436cea
- MD5 6a66e7e720552b687c9ad68db0629719
- SHA1 bf227aab97cad8a5542c80ee623f6dbace179939
- SHA512 67de5c0b4e2588460930de3e3922ffa26d9af3a9925ab5c94cf1f3e404c61cc9f003d8fb64fd0b62db8d143ececa5615a85b57a6d7ff858fe8360f19f2621abe
- TLSH T16CB0120485BA852A2C04502B15A02448C0113E046A662B046330F44991C0C6DF99A644
- MD5 SHA1 SHA512 TLSH