Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe
- Size 5.8MB
- Sample260813-bkcc3axtbs
- SHA256 327a6583f2a109478e27c304eae51da371eba6f16754816834525060f4560e8a
- MD5 50b648ac371887c0c895e983404f7ef4
- SHA1 7da515ae260b3cf9697190e75c9dcadbbdc5434c
- SHA512 6501adc124e5f9e065e4d45e89205ffd1a7611d423a02a0c8644b15ec522f143f6beaedb0402f0edd49e3acade70f11527820ea1b5d8412218d5a4b44acb6b57
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll/:Y
- TLSH T17956C8CED21942C8A82374BB8A6F813AFB9DCF24956458F4ABC1395F523CC81F9705B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2448 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2448 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Visual Assist F\lsass.exe 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist F\lsass.exe 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist F 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3076 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 3076 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 5708 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5708 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe 2448 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3076 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 2448 lsass.exe 2448 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3076 wrote to memory of 2448 3076 2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_50b648ac371887c0c895e983404f7ef4_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Program Files\Visual Assist F\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004D81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist F\lsass.exe
- Size 20.6MB
- SHA256 cc42407d2a5cc7fcff997e6e39223cbf4b8258c8a34e7f16ef21aed33a0c5ff5
- MD5 76e2aa4ac7eac5f41acf26d2cf142f0b
- SHA1 e5ddbc847b42db2bf0121583e979f80ab42aea42
- SHA512 d298c49f834d581fc7e8c6ea9484ef5860d5ba749ee906841cff4ea46706b410bea87dee1eba6af140e7475337cb394787466b719b160a33f5bcdec297d7eec1
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllJ:u
- TLSH T19F2773992B175084B9BC0A5666E4A9E380E4F90D799C49D7B2C33CBF5C5C4F0AF16CA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 e8d906d7dcfad48780bf8feef69d958619849dc73df7ba8004f55def02d2a12a
- MD5 e64977f6ceabb7ed74eda50bbe66699a
- SHA1 fa9e0cd32d8c8cde26a3ac6fd969d20105cae171
- SHA512 0d4673a4bbe22bbd7015242e9654ed6cc9b86fa82afdb2d1f448334f25f40f1c9a9274d4989bd4cdfda0c805af5526bfb86fc864c54710b5a12f4835695612e3
- TLSH T104B0120193AAC7318A49901F4972520DD070794ADE45A79083409D1D30C284DB886900
- MD5 SHA1 SHA512 TLSH