Analysis
- max time kernel
151s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe
- Size 29.1MB
- Sample260808-v7ypcsar61
- SHA256 745f7b14540d3531d90a349f42613dddd8308670ffe5042eb9f26c5a112b2c9b
- MD5 866fb94e49e5c6d14537dcdb1eaaa264
- SHA1 7da7673c288a6d06b7f26286238a848e6c1c5312
- SHA512 6a756eb3691cdccb38fedd954022db3f7eb09cbd313f42f0900738c687457c89071a38adb44e401ee4cbd930f3d4e0622b1a4ff6eea0cceab434d180c5f65677
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:Eb
- TLSH T1C067D94E80CFE2A1DD44C817E80B6191BE5672B176AED7AF4C347058E85BF7B205BE81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1428 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1428 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2972 2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe 1428 lsass.exe 1428 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1428 2972 2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_866fb94e49e5c6d14537dcdb1eaaa264_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files\Common Files\Microsoft Shared R\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1428
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
- Size 41.0MB
- SHA256 5d7e2847933bf282f6d6e59d1b5960c721a06a51cd33768c4cf35fa5f3ff1303
- MD5 b2f34a677ab5e23973cfdee9ab3260c2
- SHA1 fdce1e6695b607d194e2d6254ce6e8a821340ff4
- SHA512 d3ae8806088baea10490a75f52662c50a652f4bd2adcc29af857c9624fc2302b77fb661ebdcb20ad92befe506033711d801e731dbc2b58689c665445b9d19748
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBI:ES
- TLSH T169971B9C808BE9E5CC84C667E40772A1DCC931B17A5FC79E88723068D92969704EFFD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 384856e16c8dbf90fa9d512a2c60902d1f20794f2ed5e764dd92741ad0739228
- MD5 eccb904bc4a2d30bc86cf5cf662a7c69
- SHA1 30d374ec5bd47c7dcbed7ff2137a33faf13099ee
- SHA512 67ade47b7db566b75b39fe07bdd094718a137ea33f38b9be217b04a20784a1bed3f719c30238724d91d5b19837960b5a4225969d95ded90f7861d08bfe5c3cc2
- TLSH T1B1B0120081F9D716150150376FA61108D020BD09292A976CA72C9C0464D044EBC90640
- MD5 SHA1 SHA512 TLSH