Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe
- Size 21.9MB
- Sample260808-b3geqsfn31
- SHA256 90d7d58d3033bda2a8322f566760620ff6a0f824dadf5a28767b64b6209aa4bf
- MD5 2a3ad1b490a10a3517e1a498b7eaac4e
- SHA1 8cd3686ed2eb0d884dc6a5b904cc1cf3e7f84bb7
- SHA512 a98ac119b25de3787df8becb465a7681306d84b65ce8ef32f284a9366efa37cb7322346b58bdf9766cf76691eb53a2037151e392411f9c7c00c8c9f37a277488
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB0:Ee
- TLSH T1623753D42D3707FD879CABBD49F6195F1BF1F06E506E4261D8E3C07ACE043419A62A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2536 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2536 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared G\lsass.exe 2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared G\lsass.exe 2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5008 2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe 2536 lsass.exe 2536 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5008 wrote to memory of 2536 5008 2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_2a3ad1b490a10a3517e1a498b7eaac4e_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Program Files\Common Files\Microsoft Shared G\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
- Size 33.4MB
- SHA256 ce66716c72c2aa66794b151965855e9594a5894b90496c4f3147024c21c6a921
- MD5 3371ddcbef6472ccc3e5f699e4c06ffb
- SHA1 1a966d233897a1d32934edc66cbd6bfdf36f56c8
- SHA512 6f9e7377d42dad854960d63c7ba3e24bd985bd0c4acfdf6de84fd3f73a79d23f9676f087f84ff13de62981d28bcf2d98af28a834cbe2eb3357738ed442f6be0b
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:EF
- TLSH T19D7795D53C3703B9CA2CA7BC06F6591B0BF1E03D552EB979D8B3D475FA10241AD22A26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 894c7c4a1dc74ad9dabeea2b638565bc6e61f0e7112bdcb7db20f6741ec36f2b
- MD5 fb5948dcf6310f672988a8eeebb3f170
- SHA1 7d4263d93abcb334548e0a5d967dcf01bf579231
- SHA512 e7c88d370f1e79616488f2bb6fd21648cc7763db79c3b3f482b9698dc7217fddac2125ec86cf5b81005c864722d943bda401207da154e87933036e771f332da4
- TLSH T19EB012018CF987351884701FA5B0565BD0203D445E5A2B304720CAD458C184FB455501
- MD5 SHA1 SHA512 TLSH