Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe
- Size 5.8MB
- Sample260813-bkcc3axtbs
- SHA256 327a6583f2a109478e27c304eae51da371eba6f16754816834525060f4560e8a
- MD5 50b648ac371887c0c895e983404f7ef4
- SHA1 7da515ae260b3cf9697190e75c9dcadbbdc5434c
- SHA512 6501adc124e5f9e065e4d45e89205ffd1a7611d423a02a0c8644b15ec522f143f6beaedb0402f0edd49e3acade70f11527820ea1b5d8412218d5a4b44acb6b57
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll/:Y
- TLSH T17956C8CED21942C8A82374BB8A6F813AFB9DCF24956458F4ABC1395F523CC81F9705B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3080 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3080 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Visual Assist C\lsass.exe 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist C\lsass.exe 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist C 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1680 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 1680 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe 3080 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1680 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 3080 lsass.exe 3080 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1680 wrote to memory of 3080 1680 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files\Visual Assist C\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x308 0x2fc1⤵PID:4476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist C\lsass.exe
- Size 20.9MB
- SHA256 f8f24dd6a150a7d384b1124886010264178634eb8161e0938599c484ec5e6fe9
- MD5 a9dffb7ac47134866426ba9f716b473e
- SHA1 81bf9bbabb19d2f0eb0156f99bd0738699f21dcb
- SHA512 9fc9dd1adf6aa338871a48035221afa7c9b03829f42980b52b0d06a7cffbd17b470e46fced9aab26b37dd85b409941439a8af93e393ef8d495ee05d72257da39
- SSDEEP 98304:slllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllly:n
- TLSH T11A27859ABB38D9C0239B5A3DDD27A404E7756B04F4D428A1A5B46ECEEFF35C32671210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 e8d906d7dcfad48780bf8feef69d958619849dc73df7ba8004f55def02d2a12a
- MD5 e64977f6ceabb7ed74eda50bbe66699a
- SHA1 fa9e0cd32d8c8cde26a3ac6fd969d20105cae171
- SHA512 0d4673a4bbe22bbd7015242e9654ed6cc9b86fa82afdb2d1f448334f25f40f1c9a9274d4989bd4cdfda0c805af5526bfb86fc864c54710b5a12f4835695612e3
- TLSH T104B0120193AAC7318A49901F4972520DD070794ADE45A79083409D1D30C284DB886900
- MD5 SHA1 SHA512 TLSH