Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe
- Size 23.1MB
- Sample260813-ely51agf95
- SHA256 d1528c02a7c5e57d56b49590878b5a2a4e7bee347afc5ca17ee80e591514d39e
- MD5 a13725f7ab8612a386137eb81c68c4af
- SHA1 1a3a66ed141186212866bfd09d7911a65a7d2627
- SHA512 0c4e749dbab698b8ec8a4ef68ab742f53057c06b22fc066c3491eed7b3a70c8fd2ee22c5869614f6507cf150d2cc1f5a9fad0454b0e7d98c1d445216fbdd2771
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB2:Ec
- TLSH T1FF379506DBBB5D40971A1AEF89D0B0D5B315115DCF0CC927FB2CAAA25C7A38EF4A85D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3536 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 3536 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe 2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe 2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4880 2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe 3536 lsass.exe 3536 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4880 wrote to memory of 3536 4880 2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a13725f7ab8612a386137eb81c68c4af_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3536
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared Y\lsass.exe
- Size 36.1MB
- SHA256 736428dd5ac4dc0a3e431688b2915d9a8834d2a27bf983c2889189b400befca7
- MD5 83e295ba63e9c17b3afc202b7d27fc5d
- SHA1 c27ed88a54a82c2d89cfe9d44713ad4255224a6e
- SHA512 51cab1227f7da055aba8896d233258acb7e4df9578936c7231244966f4fe9f8d363d7564373d2bb20735e984052de11b66bf88981097bc8a63348be6a59230e3
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBS:EI
- TLSH T1DF87F801DAA718508F0B1BDB8991F2987348281D8D5CC62FFBEC9E661CE66CEF45D781
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 d6f03aec534bfad34ff6fb36ae2fce39dd3bf42eabe642b897e1f6e00405035a
- MD5 34610661b942cbf5f88254bd2927d4bd
- SHA1 762ad23aec41de6a54089bf5827b07f6548e5a9f
- SHA512 fcfdd390df58121f15d373b1da7730d836aef64967f7cc4daca1a667536a7d576a3b6e951e7c914c784ceec400f401f5beeae4d5eb70664c42cd966a51907734
- TLSH T113B01240C1BE4AE31804E0572BB7954EB0913E072F5613280F60A50B53C04CDF581101
- MD5 SHA1 SHA512 TLSH