Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe
- Size 31.1MB
- Sample260808-asbwtsem8t
- SHA256 b81159ef0bee7a11d0d1dafdf8ac53f5e6f336eb8bc09562a3562737561ede84
- MD5 ec2a93b75077c8aa544703fc8df62711
- SHA1 12197c4625d7b07c664bb6a731c10093bc0afcee
- SHA512 564106b54b38406fc110b9f03a10241b54f4b9d66411274863cb15cc5f94e6b9646556a8127220c06e59b84083ce07fa95e5184a5064321760d9b343e8042473
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:E5
- TLSH T1226793CD778ECC448C254364E7481F9DBB659642A7E9C5F29FABF816848E5282FD0F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2424 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2424 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared D\lsass.exe 2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared D\lsass.exe 2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1612 2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe 2424 lsass.exe 2424 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2424 1612 2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec2a93b75077c8aa544703fc8df62711_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files\Common Files\Microsoft Shared D\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared D\lsass.exe
- Size 43.0MB
- SHA256 461021ad88d4d2d306c0390ac762e451f448f1e831fdccdb61b0ae2c00a9692f
- MD5 693545986ff12f052c7244ac36c8dbbb
- SHA1 3efad9e35d8cccb005621fe38116cbb6ff9df833
- SHA512 b6ecf6d04515d0337f3be0b0ab4a06aa546d6ec87923d13091885a8c29f32b749180c79b9d2877072efd147c979500aa45a7de145fa284a841890a88028fe5f1
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBY:E6
- TLSH T128A796C9768DDC41CC2552E4A6481F5C799DC641B6E4CAE2EFFBEC3284CE9141BA1FA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 d5b610454860a5872beb88dfe407f5125cd3c014db9265c335d3624ab64acf5d
- MD5 4ed1436588c98ee84bd0db42edaaed1e
- SHA1 7580d4e012af54d909a39b8ade278aebb83943f5
- SHA512 415874b137312baf3969a57f4c6273dde3b9af7a2274406c8ddbf56815a87198759ea7de90d8a7a00d8c9ebb0de194cb5f384570e66b53fdea025f82639f1b7d
- TLSH T11CB0120041BE4F152804640745A983CCC171BB056F1537845310BE48108044AF7B5D41
- MD5 SHA1 SHA512 TLSH