Analysis
- max time kernel
150s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe
- Size 18.1MB
- Sample260810-lfzynsem9z
- SHA256 25bfd599f1e1b0e2fd7d2642285d987823c13b0d44ef89e2cc04d1dc248f947c
- MD5 e582ecd121731ba598c8b9d023dca89b
- SHA1 0d1e83568dc8ed26353c20003fda56f5a85cfabf
- SHA512 bbb10782e9a3c44987bda873105b543f300e1e53a21e4521c44768a7bbb8b1aa98df746248f7987c56ede7aa844575fd5986aad1211dca2d518fad3d82098b66
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBX:Et
- TLSH T1411777B5C2E2389E43C7A311B624025705EC41EA3428BE6DFECC1B5FB1A9CE99347D95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3608 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3608 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared M\lsass.exe 2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared M\lsass.exe 2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4964 2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe 3608 lsass.exe 3608 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4964 wrote to memory of 3608 4964 2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e582ecd121731ba598c8b9d023dca89b_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files\Common Files\Microsoft Shared M\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3608
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared M\lsass.exe
- Size 31.6MB
- SHA256 a400c9909a193918b474c5cffc686335bfd075aa6c61f520de5e9456338ee395
- MD5 4d43a3f54d0f9a6e52d7c469b746b3cf
- SHA1 95345ae42ffb2ce1f9ba6fc324e2cdaa3e59d469
- SHA512 db279fc4dfef849092f6d7b5ddf950adaee36b4211752452c38a82cd4baa6a1c5e122a7c1ff12cd60c35257755fd1631914ad8f007d319918fdf9c8b1ac32b55
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBm:EE
- TLSH T1DF771931C1B1317D17C35504E7A4117A89FE49EA2028E5BBBD6E26D1F6F0CA342CBE69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 b5d15b8c01e6ac3feab63b5e46afbea181df798d2a0577b5d504a40d845662d1
- MD5 61b96b398957e07954912bcd40074587
- SHA1 337fe6648c05841f425af45fe02a942ba5cf71de
- SHA512 426f83a5cb068c858e0ff3c22526edbb36b52f63e8282490f76c4c99f07cf16bc4c0aaca3cabcf28ea735a9aa1911e380d5670680144b6638b226f5b6459e288
- TLSH T1BFB0120182AD453F0801B02F0972310AF0207C04BE49175A93708E49218148DBEC5240
- MD5 SHA1 SHA512 TLSH