Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe
- Size 14.4MB
- Sample260811-bp25aadm21
- SHA256 3e604e37cc1b1514876142cb01e1af549b7dbbdc1ff60f7d1ce947ce733c0877
- MD5 59a0eaa7d4be3acb66bf6773389e6c2c
- SHA1 92c8f63cdf04210a843334db2ae234e78a6cc031
- SHA512 95ccc7bc72e2a7ea4a9850ca6f004c429cf0e9f05b5b779a8ff593671009320af2a3856d82ef234fcfa7c7917b84aa9d34624794be86aa56998a8a075d5a701c
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBQ:EO
- TLSH T100E696F0DF99209BD947B225D3908609AD0C4C3545FDE968C3BBAE848A9D840D7EB3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5424 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5424 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared K\lsass.exe 2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared K\lsass.exe 2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1212 2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe 5424 lsass.exe 5424 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1212 wrote to memory of 5424 1212 2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_59a0eaa7d4be3acb66bf6773389e6c2c_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Program Files\Common Files\Microsoft Shared K\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5424
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared K\lsass.exe
- Size 27.4MB
- SHA256 f1f01842078a6d2ec7fd68845d9f6df08a38a8c0f117328956e8acd8a1ff1049
- MD5 e2956ab344d9ed40f1951b6af0832061
- SHA1 05ccf8bd9a0c2716f2d82a89bba23866a138c655
- SHA512 d9236650012b926216394af5b918d3255a7350f098560ed4efdd46550b543b84f766380f6cd702a2f975b54f9f4444e8306c99455cfcf59b562d6c18b354ab38
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:El
- TLSH T1B057E8D0DBA42247AB2371604715CA4CAF0A593589EC977583BC774DC65AE80F3A33EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 f6bcb6952ff968b7e06df7af4019ee2ccf5893a4db7b0813d30b6c90940548b6
- MD5 c1165c28c4e4edad2743aebf47eeae48
- SHA1 ad969df6e9092c622d2817e5d2e338292be9111f
- SHA512 33ac01e433f8ccb154687ac8db9bbd7714fc54d016b9a77516eddd50c0fcf35fa66146b54730162e155b0ba0525a6867b393d643807bbfa56684f362c302b732
- TLSH T1A6B01200C0BD49334C13601F1967894880347D557E5517C65314894C2CC4949FCE5B00
- MD5 SHA1 SHA512 TLSH