Analysis
- max time kernel
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
General
- Target 2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe
- Size 33.3MB
- Sample260805-aexalstdpe
- SHA256 13ef06b28e3bb8056b077006e53ad024c158bb876d0014edd1f2c6954607e82e
- MD5 e7048db112e2ce00a609a24a9bee81eb
- SHA1 9d91f35beac55a9bec7f6e1c867b8182fabd08cc
- SHA512 ed42c3aae4f289fe675c7e3240409efb7a63feae96dc4af35aa978742958bc538314b3b39458dba3fd683be02499279030b343d87d3c1c082970513cb775a1fa
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB+:Eg
- TLSH T1E37784E984A0943D23C5E1825BAF63AB7CFC226047BD53D987E71077B2251E6EE25C0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4220 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 4220 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared I\lsass.exe 2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared I\lsass.exe 2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5164 2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe 4220 lsass.exe 4220 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5164 wrote to memory of 4220 5164 2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e7048db112e2ce00a609a24a9bee81eb_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Program Files\Common Files\Microsoft Shared I\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4220
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared I\lsass.exe
- Size 47.0MB
- SHA256 acafcabe0f8128f07c0828bfab7bd98c269d20f6dbb10b1aa4a500d4b3a5ca04
- MD5 e213d03226038f8694c371338d4786f2
- SHA1 727548456eb660e99b48ff155985ceb502ac4b94
- SHA512 de239d2a3ff1d5cee686ef09cc9f0ba69501f933775d419f36f4ec5a91b234b9bab2482fd98b7f4ee0412ed111c72f7d710edf795d1920333fc7108492ed71b8
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB5:Ef
- TLSH T194B7F7F98098997E77C5D186936F635679BC204062BE27CDC6A610B3B1390EFF968C4C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 ca7d5d3d25c810df57228ceea6d698e11463672e86f32821ab1eb9300f0e4117
- MD5 4f87e7cccbefc99895ba2035ba9bc600
- SHA1 97dc1ae729eb77d055a9c8059d7be0cdcf809b40
- SHA512 84cd26866f98f3c8ac8d221232e582561b5bb27995a5b6b038540d4c02ccc673bcde18bda6a0d2f8804ebaaefc9dd4d12b494c8e73598a6f6b9b980245ae3811
- TLSH T19EB0122081AF455B044170672AF0A99EC031B81D7D2A674053519E0A6780909F591103
- MD5 SHA1 SHA512 TLSH