Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe
- Size 15.6MB
- Sample260813-e36w6sbk4w
- SHA256 0c60e122a13d4d4553cd9c5784a4c5ebf6d4320fe84d0aa4966a103f2f65fb34
- MD5 7e64d31a7e5febfac9a9909dfe6b4936
- SHA1 e8d82f9f6d08bb8d8a5783a72dc9825b26104e36
- SHA512 bcb48d8094c63e3cf32572ce21c872ba7f64b6d2ef25d5dba26dec53832a6c700ce02a1b89885db2a69deaffd38ab7ff45d4b5373666990d95004454c8c30193
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:Ee
- TLSH T16AF6EE5C602FAF2BE8D6486E4D5102A1D942E3E3B7E1F278F992D9110257D0F093E76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2896 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2896 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe File created C:\Program Files\Common Files\Microsoft Shared A\lsass.exe 2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5996 2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe 2896 lsass.exe 2896 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5996 wrote to memory of 2896 5996 2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7e64d31a7e5febfac9a9909dfe6b4936_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Program Files\Common Files\Microsoft Shared A\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared A\lsass.exe
- Size 29.6MB
- SHA256 ebcf24544ae225408eab52bda1a08b2a2ebbf4739aa45898c0aeb7711fbeb570
- MD5 3acef9bcc0156dd7c2c6a628a57f22e0
- SHA1 c44370758d643d9ff7c1e599273c49b7ce828a0a
- SHA512 e61e01cb9cb7dd3529fbdae307a355b90a840ca6381e08d5b782100bf563e2cf5fa469e5f6b09dceacd487dbcb0969559229e5527234b30b316c8db02c80c59b
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBP:Ed
- TLSH T134676669A09BBD76D0D944BD099112B5C5C7F3E293B1B278F986D420A32BD0F0F29397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 e20ad643f67aebf7a1dfe0eb8b37d8fed69c4e24106821feafb865d7fca23398
- MD5 549196e60d124d9812b27d3b4f042f8a
- SHA1 a483bb4f6ffdaa7f73d68eb12ec1936bd225d0e0
- SHA512 3c6bbd39e5844cd154c684ba5bb4787e50c63ac28df0ff25681e4960804fa622b4acf20e55f61c3f432c90b885729dcf4d1bc027c8b7b525ecb321e38f51fd39
- TLSH T19FB0120841FD45251C16A10B35F53D09D230F8082D161744030DC60A618144CFD94104
- MD5 SHA1 SHA512 TLSH