Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target 2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe
- Size 25.0MB
- Sample260815-aex7xavyet
- SHA256 ca0a2f8543a992cccff97abb2c51a34fcb74f5627570893dcc31791910c009cf
- MD5 2fa7b224282ccd71086b7644df7fc4b1
- SHA1 63d8ea58d7fcc9c3aa9dff137a871f5e5df108a1
- SHA512 ced86396c433b09efa076e948917cbddb2e97b41d7c32f17eed742db14342cabeb8c25902f45d6f38d7c8f51b9043cae541baa748c731c0d68a39fe7fb90896a
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:Ej
- TLSH T1A147850A2BD1F4F7E5E7A1CC8A613799C1D8085AE6C46BF72CA4C5F132837A95788F14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2472 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 2472 lsass.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared O\lsass.exe 2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared O\lsass.exe 2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4228 2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe 2472 lsass.exe 2472 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4228 wrote to memory of 2472 4228 2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2fa7b224282ccd71086b7644df7fc4b1_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Program Files\Common Files\Microsoft Shared O\lsass.exe12⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared O\lsass.exe
- Size 37.1MB
- SHA256 4490941faf7e3b93dc09d11f9f0189c7c9267b82b66861f6bccdbc20a4819dbe
- MD5 351c9b5414dc5e31a8bfa49b38f3c4a8
- SHA1 cd4db4a1125bb16d1ac3ad82cac72fd41a4b645e
- SHA512 e97310c26930d8b0a040428a667e9831b1ebe2103a0bdc062239767b4dd603247f9fb9a59dce903e569c116d88ebe6c53e3b466bd78d85f9c61363e2c51a211a
- SSDEEP 24576:ETBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB4:Ei
- TLSH T10A87FC8A36F478F795D6228487613789C8F54D28F5CF5B7B28648CB233C276E269CE14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 50332317a18a65eb6b8a4b96441b95e943be80f18e4bac58fbb1c6c19e4bb8fa
- MD5 61caaa054fdc32a42ace6a8e1db4ab48
- SHA1 24e83d531032376b4a26617bea0a7192da5ceeac
- SHA512 f5fc56de0db2bc3d8dd058fb8e128b4279a5175629d6b6ddff14eebd9dfeb1c2cb2997971f0e12093f11e6b34e4123c0ee20031fab0046d8d203050ccc4e0273
- TLSH T176B0120041FD85352801A01769BAD54DC0307D4A1FCE7B5113308449E4C144CF787131
- MD5 SHA1 SHA512 TLSH