Analysis
- max time kernel
151s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 21:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe
- Size 30.2MB
- Sample260819-1vlf6axset
- SHA256 6d53279f81abd4ac829626ba2285daa557adb3c284c7c9808966ffc76674a377
- MD5 d5af4e5b5bcddbbf537f39c3cedc4ac8
- SHA1 1a5da0694386afd1528edff1a9d7a168f9499ca3
- SHA512 5c33f26f43382a6ddb5719fe9a50f927f5c709a22d69ba102658829df971962963fc0254bbc40ce8f5ab3ac0e9d6c5b08aef4b144c136f5272e5133eff8f9336
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll4:7
- TLSH T1BB6775E3C6A345A5D34E49BBB0E88B126D63347E6DC86119533E191CD33BCE1B60A277
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1948 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1948 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Visual Assist S\lsass.exe 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist S 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe File created C:\Program Files\Visual Assist S\lsass.exe 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3380 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe 3380 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1924 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe 1948 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3380 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe 1948 lsass.exe 1948 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3380 wrote to memory of 1948 3380 2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d5af4e5b5bcddbbf537f39c3cedc4ac8_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files\Visual Assist S\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist S\lsass.exe
- Size 45.0MB
- SHA256 e6968a45694411458cdf1e0ec79ad535b84841c48264e855a4f484c9912baa2a
- MD5 27de283e5b47ce53681ddc9cc2ed1ff1
- SHA1 fab83dfa05c713249afdc2eb6efd5b93c7aea6bd
- SHA512 176a14be1927286a088e5e157cf8f52e794dcc7fa84d16b60a45d875f3368992a97ce8238d1cd3098adf93b140ef28c73afe56715cd27cebe763707b9db5ecf1
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllr:I
- TLSH T10DA7DAD385D342A4E2464AB770B8CB075D93347D7CD8A11D537E4A28C26B9E7A23F236
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 f330e4f2c80ebd61ca03e5061dc8a6cb8919fd10857e90e476b0f547f0144413
- MD5 bd274f87835426e062cd1fe21a7abff3
- SHA1 64193000f1cfb5c2913a93137c146b8b26f9404a
- SHA512 22ae033060f6fb71dac2b74061914f102810b9c6f00e1e3703612bbafcf549c841374bc16bebbb9e764ce2f565e35aaaa33fb9bf66493fc1537401a822433a92
- TLSH T155B01211C6FA49191840A40F05FA0709D0A63F0C9E5D23543390C80461C2619FEC8140
- MD5 SHA1 SHA512 TLSH