Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe
- Size 13.8MB
- Sample260819-cel6rawydx
- SHA256 2b040ede910f53b2bdab5e90130a2a795554f392f5f6fb6ca622f1aaac4a3b68
- MD5 374680833cf76311c3a5cae24559b780
- SHA1 967c4e666e2ba34a40b71b48310fe64258f047ec
- SHA512 6c80873247fdd92ef7148a328137cdcb43dec072fe6fe5372c78e98fe71ce1916e29ecdf2dbe07158fc8c44b15118d336d67d5c79c60b8b37947fbc5f4f37e98
- SSDEEP 1536:2Tw/ylFUqAlefaKe3JZcIWa33X7x7jnQS99999XzTjR1AnjBWuV6hoNE2dD:2T8ylh4f5JBjnoNEe
- TLSH T1B0E6025C59E71003BA364C2674F80DAC5985285F32F8827CE5D22EECF6791627DAF389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4288 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 4288 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Visual Assist X\lsass.exe 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist X\lsass.exe 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist X 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 940 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe 940 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2924 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe 4288 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 940 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe 4288 lsass.exe 4288 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 940 wrote to memory of 4288 940 2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_374680833cf76311c3a5cae24559b780_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Program Files\Visual Assist X\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D81⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist X\lsass.exe
- Size 28.1MB
- SHA256 033bfb260f29805720ea0c5f804deedc8f83a46f08c88554845d1e801ae6769b
- MD5 bc857c861f182e43b283effaa5b3bfa6
- SHA1 d8e8ce5752ba182f1938bb9562ae929067d27ed9
- SHA512 02d76cfcfd7e4ce22e4d5203de5382d9bdfe5ff9445d607fce5e7174f0c8b928ac06c73b79a6cf458b83c9d8341f3a8d49c5a38a820d3e4f510a8c3ae6656cc5
- SSDEEP 1536:2Tw/ylFUqAlefaKe3JZcIWa33X7x7jnQS99999XzTjR1AnjBWuV6hoNE2dW:2T8ylh4f5JBjnoNE1
- TLSH T12557C6FC69B761D1A7664F11B6FCBAAC5508299F31F60758E7F02EC8B2AA110D1DC243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 593b720535dd9d7fcf6b4297eebeae51564bc906116f6b4342c8158aa6bfd65a
- MD5 09cf497e575f46186698ec764b2bd4d7
- SHA1 0a2f69848e7fa15673eb4356e91d1e99374c5c95
- SHA512 acc2507caf2360120e204cebcbae7708f2a183178bd4267455a714861b4e0a9bc96c1bc1f35178d690d19a61a82f9f2d82b89d5aae8269a968fd5215763dac5e
- TLSH T19CB01200C2BD492D2D477107C6FA064DF5657C062F493F40C310851C508148AB845140
- MD5 SHA1 SHA512 TLSH