Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe
- Size 12.6MB
- Sample260810-fm2sysbm6v
- SHA256 5ef86a02c92fd176b8dfab9e92c2976d0619ca1e98cfeb25224034a884fa62eb
- MD5 4586f4ccc1d080c2f8217d7e156bc6b6
- SHA1 ed278e7610f97be8295fb97f763619250013ec04
- SHA512 27a109135071ca352ceac02a59ece5753527934bae3870fde268f60b426e890f1fd9a067f33f1c1c731b5782db59da2d8bd67cdaa32b4b6e2d13ab41879bbd38
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBm:Es
- TLSH T12AD6136BEC3D90EFD725641F8246F7292E9A459EE246CC115FC8471ADB9C8B4C62CCB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3012 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3012 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared R\lsass.exe 2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4976 2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe 3012 lsass.exe 3012 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4976 wrote to memory of 3012 4976 2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4586f4ccc1d080c2f8217d7e156bc6b6_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Program Files\Common Files\Microsoft Shared R\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared R\lsass.exe
- Size 27.0MB
- SHA256 0af0a0af73ffd2f50e2bb81e6f08e96e1861e4cedb79ed5f1b51ecc731f0bcad
- MD5 7b06a98217bd9692e280c02465090192
- SHA1 24a4037240e4a30987f401823e83a2220d68fbbf
- SHA512 a572a4b2586c7057feec2af72488a453f21a04a0160bea107f1b34fa2d4d6bb1c62cf60193ba072be355260216c9869a3b2c2b695a6fc92d55ac7e492eef51bd
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBk:Ea
- TLSH T1AE578567EF7E514842122F0F8512C5E7A9BBDECE838F6E049ECA4B55CA8C55EC204DB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 f8138f0fe9b2934f71f469dd95a89293adc6fb9f49c0c955b4357b85ac216e76
- MD5 d5277c58cdd973df1585d8fed4ac0b32
- SHA1 11c88f526c784121708f46d51b7ee55846da024a
- SHA512 ad5feacdafaf52f85a164e4077d6ba4ece39090376db9e046cdb3a94385d00afb8e19104eda0d43449624c1780b3663f87d5709118665ae817b3e047f02b5d22
- TLSH T128B01201C4AD8D160A01D06B0575120D84213C48AF2EB7000301894829C6F08BDE4150
- MD5 SHA1 SHA512 TLSH