Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe
- Size 17.1MB
- Sample260908-fsf4fadj5v
- SHA256 d53ed6e017b0a18d917480851ebd88894df89c5148adc666d694a3c8827eae2f
- MD5 d255db8d691d866122193d82867e08c8
- SHA1 b108873c86be87916b978f01b15372b73e352eab
- SHA512 aa932a873cea76b393d0a16cc06535d8f55f6b0c7255e666f34ceb564a7a579d90a06226f60c268c51da30a2378c7c61058cb00cf1bee3bb1d0e626e2ea9dfce
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllC:/
- TLSH T1F20756C9BBB000787A5E1CFC504D4578D44BA6B10CF2F0E9185F7CB3A37E4A26A9657A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4776 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 4776 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Visual Assist T\lsass.exe 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist T\lsass.exe 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist T 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1700 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 1700 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe 4776 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1700 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 4776 lsass.exe 4776 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4776 1700 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Visual Assist T\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4776
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec 0x4f81⤵PID:660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist T\lsass.exe
- Size 31.7MB
- SHA256 fac728b34e042c1dc09eb312e28efd77ebed036093f6f1f94eb57ddd8687fa03
- MD5 1603ca7888a7e5cd87b240406b9bca7f
- SHA1 3a3f6a24a388c9aa5db4d3c5196bd5f733ced55b
- SHA512 186297afb87a870574c72f84cb9562c26fc5f41b6c054fb6a4695c674e336fb4aeb018159ad91d4d7f3d7b9d5170a211dd0e7f3000cb5acf138e3a9bb868d8dd
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllM:N
- TLSH T11B77B8F7AE78142520BE5CB8D41DCA68C40FA1E29EF3A1B600CE3C67B7B3452E5551B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 632d77cbd03668ff1298f65bd350efcb2fe2309947f1b2799c4b27aa52efdc06
- MD5 d26e6c65750ff6e6f3ec3c2be463563e
- SHA1 9c35db19fa9c33d850c7450880a649f3781c1820
- SHA512 908a8ad844230d2e96cefbe2e2ec92b65df0cfbaa5f6d3c259322ba6c2ab088062c51fddca69f2591d2bc04abcb936396a25fdee247b79ce1e5cc59dd67240e9
- TLSH T1C1B012006379857384089117596D434CE1517E042E5B178C0B208A5530C140DFDC4141
- MD5 SHA1 SHA512 TLSH