Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe
- Size 4.3MB
- Sample260816-erpthsbb56
- SHA256 a65ec61f7c30c35705d5779e80d0277f076e82df3edb510eb13d3a57671258b5
- MD5 882b7eeba1a90eca1e5d634b6749019f
- SHA1 4618b636259cdbb53e1b411a710c447a8b90e752
- SHA512 6e7ac2c51a580059e12c800ef3089c38d0878b4f191f6dc5beeb4fac0b7872fefafd075bf1a08cce3f56a9bedaebe4f494d2587761338497fa6cb8d366e2fa51
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllh:K
- TLSH T1BD2673D9D21941C9E92368F75A3F8538A78ACFB4956484F1DFC63C5F4234C82BA309B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1620 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1620 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Visual Assist D\lsass.exe 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist D\lsass.exe 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist D 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4144 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe 4144 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3672 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe 1620 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4144 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe 1620 lsass.exe 1620 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4144 wrote to memory of 1620 4144 2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_882b7eeba1a90eca1e5d634b6749019f_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Program Files\Visual Assist D\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F81⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist D\lsass.exe
- Size 16.6MB
- SHA256 8199bbf38fb8fc2329970907193b07986004255c3f875543a7bee15ba51b75ff
- MD5 e6ffc8d162afc7702e7c6e3e83f879dd
- SHA1 03ed15c15004612abd5fa4039c01168d6e450b2b
- SHA512 289379ba424e4246fbd27f9fd0765e443f47de310894d8bb47b0996050ccb9fbd16f7b8ad717eea7c2e8d847a402585688231c38720853b91c5dabbc54ad3608
- SSDEEP 98304:slllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:6
- TLSH T1CB0754819C4C17F93CB3C2E20D8D4EE3D27DF224609A5FD36FD928ACE83521925756A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 e786655331378e6be1d7e22ad377d1c886768a8bce4c2ac5319df8931e2c2adf
- MD5 8598bf55bfbf9b065227d8c4a5125d2e
- SHA1 ec30515c3a1881dd65dad10a36c3d14685588626
- SHA512 34c8e83149b67465318258cdc740273ac6fad7577f408366a0715d9965762a31e4fdb30b0d4b660dec5ce116d0e86df0f7c1f942b14691d8b43024ceea604a79
- TLSH T110B01200C1BD47D50C45500B35A6558EB0927D451D466F400371D405B8C1C8AFDD0180
- MD5 SHA1 SHA512 TLSH