Analysis
- max time kernel
151s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe
- Size 31.2MB
- Sample260808-ap2yvaem4t
- SHA256 22ed434355d4a77b8fe7fd5d77168c8c375338855b7dddab6ab5b18c79d42cd2
- MD5 f857ee82b3f56e9eb973fd39115ee571
- SHA1 df6648ec7d0383fbcc585d704c95a173a92adaef
- SHA512 6b8f2196d609381269a4c34391b9c157821a7e470255176497929fd380da331a77c83c27f22983ddd07ded957c21de0aa7d6c4053266657eaf36a6b940303a87
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBN:Ef
- TLSH T174771ADE0A6815755FE9CBF1F3D43269052C9ADB005B1EBA3DA0D1B0BD40A89548FCAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3340 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3340 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3528 2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe 3340 lsass.exe 3340 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3528 wrote to memory of 3340 3528 2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_f857ee82b3f56e9eb973fd39115ee571_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Program Files\Common Files\Microsoft Shared A\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3340
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
- Size 45.0MB
- SHA256 504be4fe941ed4fa6d6a3d93e6e3328beae72ea923f85697496fd19330d9f598
- MD5 784424fa319ed030d7a756e72a212032
- SHA1 2a8495365ee11dd0bb326ec9e4d53fbf384d2f3d
- SHA512 62a084d80de6ca575830197db89b725a29c09ff933a9352666ec0050da3278adbf229bb8ca57f6c04b4d351dc7652bcf236738e6b57979edb0789bcd696df36f
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBI:Ey
- TLSH T1CEA7F78D070416369B9E9FB5F2F4331401BE5DAB025A1EB5B8E4C1A13E46AC7205DEEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 c62434bc576f7560b78c10033752ebc10a94e30b5679597174c30de28245c2f1
- MD5 2aaa4cd27bf21d73b0df50bf37a229f1
- SHA1 739754f39b9f50121ab5caa46d05d4781ed92fac
- SHA512 752fec8125515e185f9a229f939ebfd96c684b652f53b9fdef7f649511662a3e97de1e9dea62e3c82878db50d90c88f3789946909dc93dbbb5320dd2652bd2a3
- TLSH T175B0124096BD4A320901702B56B64419D07338189B15171053108D456484529F485706
- MD5 SHA1 SHA512 TLSH