Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 00:33
General
- Target 2026-08-06_8f5ddae5631bb40854f682ee49163a0e_elex_strictor_wannacry.exe
- Size 4.5MB
- Sample260807-awa4psdb82
- SHA256 94504fc9b710113adacf32513b8f6d96452a22dae8514d5d6d563efce22b8e0e
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_8f5ddae5631bb40854f682ee49163a0e_elex_strictor_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_8f5ddae5631bb40854f682ee49163a0e_elex_strictor_wannacry.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\drivers\lsass.exe"C:\Windows\system32\drivers\lsass.exe"2⤵
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_8f5ddae5631bb40854f682ee49163a0e_elex_strictor_wannacry.~tmp"C:\Users\Admin\AppData\Local\Temp\2026-08-06_8f5ddae5631bb40854f682ee49163a0e_elex_strictor_wannacry.~tmp "2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-08-06_8f5ddae5631bb40854f682ee49163a0e_elex_strictor_wannacry.~tmp
2298281914bc4f5cbe17086e7fddfda0
7f851770af45432e97a78d60357379f8
ZBCWSHUB.dat
filesys.dll
MBX@1528@24C25A8.###
MBX@1528@24C25D8.###
lsass.exe
memory/5416-47-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-53-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-31-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5416-30-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5416-20-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-23-0x0000000000401000-0x0000000000402000-memory.dmp
memory/5416-22-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-18-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-21-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-19-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-13-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-32-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5416-12-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-264-0x0000000009250000-0x0000000009282000-memory.dmp
memory/5416-260-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-393-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-395-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5416-394-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-396-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-397-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-401-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-407-0x0000000000400000-0x00000000005CE000-memory.dmp
memory/5416-432-0x000000006A9D0000-0x000000006AB25000-memory.dmp
memory/5416-434-0x0000000000400000-0x00000000005CE000-memory.dmp