Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe
- Size 25.8MB
- Sample260810-fb1rhs1eph
- SHA256 4c411b83d7dcedb542ec86f039788c9e3d2bf5041deab68993de8fece4600bab
- MD5 719d42ac49b65732475d2ebe4faa41d4
- SHA1 5a5e4199940918ca1955d17618e4971d010a4a22
- SHA512 d5bff0da7e0cb1f62c9aa84e68a52db293b64ef32be5425f319130602eca5bcf97624da9f9fdde0db131014274fb03b760ac69577f7a6e5b728defd9fbcf2501
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBb:EB
- TLSH T19657D8EC7A97B8ACD432FE4F48DD2F3664469C06BA7C4C48986AEC25B7F40DC1965780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5416 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5416 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared N\lsass.exe 2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared N\lsass.exe 2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2900 2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe 5416 lsass.exe 5416 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2900 wrote to memory of 5416 2900 2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_719d42ac49b65732475d2ebe4faa41d4_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files\Common Files\Microsoft Shared N\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5416
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared N\lsass.exe
- Size 40.9MB
- SHA256 bff801c6ac37175cbfd5fa879326f4f60c4bdd4c3dabd8ae798855152af2195c
- MD5 b47820584399d9133c0464d817cd84d4
- SHA1 432175d737c544a54a41cacbefe6ec02c8dfc959
- SHA512 324120add7dee42e3e5a893e5f42447439dca2a2a99e90d3cefd456a440a8f4dbe31ddbc772a5b17c7242eb6991c346c683d059bba8731943dac9638841c9cdf
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBu:Ec
- TLSH T16597DA6C76D7B5CC9822ACEFF0AC1E2D7D02DC047EA55D4A9C19B815BBB46CC2A72344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 6e17fcfba664e406a572e29ab9fb8bd8e400545ccb85f6dc0f61087222a37767
- MD5 deb6cc0da5f5190c1dd7372f501a7bfb
- SHA1 08461bff5ca4a063749dd37682c491895eaac3b8
- SHA512 7fbe2b81e0b82f5ca50fb918e3539155c872553559bc73d23b97b67965b5ef2087c52c91846aca15c405d5d182dff265eb13bf3b58d7f93ec31ada5ce6b047cc
- TLSH T143B01200C0BD87754C05A05F2B7251099061BD052A061B8C8753CE4D15E084DF89C581
- MD5 SHA1 SHA512 TLSH