Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe
- Size 13.0MB
- Sample260810-e43ada1dqe
- SHA256 edd8e574188476edfe857483f5d585e061821ce0601c8641b96ffaaf0c9effc9
- MD5 87c858611408a8b7ce7185195b935dd3
- SHA1 7be744775cf5c2cd1a5f1c74874633905317820c
- SHA512 ddd157c7003b6c4b6b5a8c2cc1e178e68552e27565d97c796c5eef08a8d8c7e8f98a1a7f406277238319a44ca6715b88598fcbd67542b08e3a6fd9ef07d22643
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:Et
- TLSH T19DD6040247283A9EE58ED3E4ED3B4D971CC1A10B77B5C6D382B24E71ED99A7179D2E00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1704 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1704 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared M\lsass.exe 2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared M\lsass.exe 2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2884 2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe 1704 lsass.exe 1704 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1704 2884 2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_87c858611408a8b7ce7185195b935dd3_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files\Common Files\Microsoft Shared M\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
- Size 27.2MB
- SHA256 de3c833ccdc5cd4407be378256dffb079a140a094b1166b9d747761a50dcb47c
- MD5 c37b626d311c4db405c0bed85dce84f6
- SHA1 50296b9f5fde07fc6fc0582d9631b1cd265bd75c
- SHA512 e732bd0afb3bfd96c00f048ddb78c06b00036bdb37930ff68c119ddd84f47a3dfd21613f29901c84e668d41e57b8d428ef8fcf45877e5128a2c22f5eb6b1ebb7
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBS:EY
- TLSH T17157B3030B29699AAA1EDEE3F839CCA66DC0E2073FF093D354F14D525CD9D615AE3660
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 3a9a30e1704b6b4332ae6bba4f74c46e14865838c84096be3a8b0031e69e8130
- MD5 3930c45cb8954f732edb9fc615edd1b1
- SHA1 c2cc40a6a6b75ddcf563b4684ce03a9adb340b6b
- SHA512 47de076e9eb56f758c5998b7ab52c7fa3bb9c88ee0022581da31b4d4494cf321c24c4c22b2fc7a760f3abe21c473e4d16e6fa198309bdaeef69f4ca1cf461b24
- TLSH T1B1B0121080AD4A522F01B08B16F94A0D86217D0C5B59735027108D44518050CBE81100
- MD5 SHA1 SHA512 TLSH