Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe
- Size 2.5MB
- Sample260820-b26cgadj8s
- SHA256 8cd8809ad8f41d930aa00209583d78cd80d102fa22c1e9c13cecb440926384d6
- MD5 7ee192065dfcfa9eeb1f4e08657a0311
- SHA1 c06a34db0db9cf4aacb6c8ae8ba974163a8bedfb
- SHA512 9d87509a23711867a60535dd83f4432d16aa38e916d7bb975d324a241b24d14e248ab819e429bdff8da131eec98e275d33d2aba77ab4fcf200a14eca9ac83419
- SSDEEP 24576:exNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNH:W
- TLSH T1EFC59799A22555CAEC5754F31D7EC635A3CADF78D2AA40F08EC23CDF8231842B675839
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5528 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 5528 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Visual Assist P\lsass.exe 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist P 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe File created C:\Program Files\Visual Assist P\lsass.exe 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2496 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe 2496 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3432 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3432 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe 5528 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2496 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe 5528 lsass.exe 5528 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2496 wrote to memory of 5528 2496 2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_7ee192065dfcfa9eeb1f4e08657a0311_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files\Visual Assist P\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5528
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004981⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist P\lsass.exe
- Size 16.3MB
- SHA256 1c31450bf855c853029ea23d93442490516473aa7ecd4b0ab5ded5da8075c516
- MD5 271c8ada40f3306c8379b5b45f2dd249
- SHA1 cd4591984b0208c2002dfddca8848c71c36bf3fd
- SHA512 8f15e1cd1ae5dcaedb2d9adc12b08f73733cacbbdd905ce2fed83e49915c37ad465be8de54c0cae961e0fa931c78ffe63123e138b99a6dd5ca3b0d73856050b4
- SSDEEP 24576:exNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNT:6
- TLSH T1EA07533C808973FAE0DB67B36F8CE52A61B29EFD6D606840C0C177DF2A562906C16775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 0351d7f265291aaf91de9ce4fcdfdf9d37782f8614e344a383eef5d91e57d399
- MD5 0b544eb793fa03784e1df20c2b4de0d2
- SHA1 585606fbcb3c6c64beefc4140c797b112bd8d6e6
- SHA512 2f2188c2474ff5c15f9d7f17fbfdc359728d9850fdfe671fcce38f6dd454b53fa9d81bc61a52b59973f5a341dadaa7c358023289bb5b48b7df5ebf39e7b26e30
- TLSH T13CB01200C1BF461E6C4690275ABE0949C03178042A5B63968300C74460C1889B446240
- MD5 SHA1 SHA512 TLSH