Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe
- Size 28.4MB
- Sample260811-eajaeafm5s
- SHA256 1c8231b63ec097aff1acdc70152520f39af9e44c12dcba7857a6d32979d9b3ac
- MD5 1cd93940f0f0e5a1d04c3aef71007c9a
- SHA1 d93a6de2ca0f09b70c9a9a7690bcd753cef88730
- SHA512 105084d7b80b548c47e96666b2c6b9901db4577df6f47236da4be185886fe840e968a39e30f257eefa98ff8719b7f43d5defa133fdc30db9456c721eace66375
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBe:EQ
- TLSH T17B67B7B6EC86542C3AEB60C9BE55820FC7D6B235C40F51A2F2540D6ECB9D509FB39728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1352 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1352 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared G\lsass.exe 2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared G\lsass.exe 2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4236 2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe 1352 lsass.exe 1352 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4236 wrote to memory of 1352 4236 2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1cd93940f0f0e5a1d04c3aef71007c9a_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files\Common Files\Microsoft Shared G\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1352
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared G\lsass.exe
- Size 42.7MB
- SHA256 7f5da69622ba13a2885a6e959276e1b80e360e9f63a775a5b5eafde057b2570d
- MD5 ef156783b5a006f6e5f7dbc174373e5b
- SHA1 70842a14d8c35f59c0aec40c875a175b83165d19
- SHA512 b4e8251a44ecb38cc466376a107cceb170c462b8f841a727057058b9ea465a9c9a8c38b6317c4c8f24d3dcf7abc7d66c2df846b2d0e2f58b865275e7c0e4b2b5
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBh:Er
- TLSH T1FAA7D6F1D882B66F76C655497B81E20FC7E8B12DC00B5961F681057D8BDF086ADBA32C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 25fe58e1fda6f9413dd1b389f5ceafd7ab75971b85f2a16da48b6e4e7c118113
- MD5 bb34bd3a54b75a3121dbe0031c00f697
- SHA1 53da348610cfaa44a1532ecc8206a9ed43308279
- SHA512 66579ac7420d28ee52434928f48c21c77e50bd2f2ab8d5832e55526e9a10a30f6419437eed38140a04fcb6b925a6423ccfa43dfe85ec236f1c3ebe3feb883bf9
- TLSH T193B01200C5ED49115D81A21F0D7E334FC170B8142E0653C88B289E4A64C0849B990241
- MD5 SHA1 SHA512 TLSH