Analysis
- max time kernel
150s - max time network
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe
- Size 17.1MB
- Sample260908-fsf4fadj5v
- SHA256 d53ed6e017b0a18d917480851ebd88894df89c5148adc666d694a3c8827eae2f
- MD5 d255db8d691d866122193d82867e08c8
- SHA1 b108873c86be87916b978f01b15372b73e352eab
- SHA512 aa932a873cea76b393d0a16cc06535d8f55f6b0c7255e666f34ceb564a7a579d90a06226f60c268c51da30a2378c7c61058cb00cf1bee3bb1d0e626e2ea9dfce
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllC:/
- TLSH T1F20756C9BBB000787A5E1CFC504D4578D44BA6B10CF2F0E9185F7CB3A37E4A26A9657A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1316 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 1316 lsass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Visual Assist A\lsass.exe 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist A\lsass.exe 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe File opened for modification C:\Program Files\Visual Assist A 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5060 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 5060 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4744 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4744 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe 1316 lsass.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5060 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 1316 lsass.exe 1316 lsass.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5060 wrote to memory of 1316 5060 2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d255db8d691d866122193d82867e08c8_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Program Files\Visual Assist A\lsass.exeAN2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Visual Assist A\lsass.exe
- Size 30.1MB
- SHA256 1351a6927c0fc0374d695e2d48bf3014cd812aabe6f686a114da8d7b0b5a061a
- MD5 bbe87bb7feff0df80eaeb58f1d1d2baf
- SHA1 882558c48d1917c43b30303e28dbcbba2674c450
- SHA512 f0f230d75f040cdd574ceb445dabae9d29599e1ac9df02fd5fa7aef7970a66984c0c0b5371c77a041e0db30e5e5583e2fcfbb8fa1c4005cb3b21f0040a5bdedf
- SSDEEP 98304:sllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllB:C
- TLSH T1FD67E882FF71413065AECEACD09E1122528BAB7109FF94D93C9D3832767F4B96111BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemTemp_1
- Size 95B
- SHA256 632d77cbd03668ff1298f65bd350efcb2fe2309947f1b2799c4b27aa52efdc06
- MD5 d26e6c65750ff6e6f3ec3c2be463563e
- SHA1 9c35db19fa9c33d850c7450880a649f3781c1820
- SHA512 908a8ad844230d2e96cefbe2e2ec92b65df0cfbaa5f6d3c259322ba6c2ab088062c51fddca69f2591d2bc04abcb936396a25fdee247b79ce1e5cc59dd67240e9
- TLSH T1C1B012006379857384089117596D434CE1517E042E5B178C0B208A5530C140DFDC4141
- MD5 SHA1 SHA512 TLSH