Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 04:32
Behavioral task
behavioral1
Sample
2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe
- Size 992KB
- Sample260415-e6f5xsey2l
- SHA256 19678bee632b2a30b248db0756297e32729668ae51ed53b5f0f2630c619c1528
- MD5 cc868d12f452742f357f0aecbdc54185
- SHA1 f65b68f44f4339424c40c879d13fa7e9d4795ede
- SHA512 0c455f9b31d2b8861aa5a458262689a3f36784ca874b9c7adf7445d389bfbe19c04606ac52bc26613c6dc428eb4031ec4839d0a984b5e369ea7b695ed342eaa5
- SSDEEP 12288:GPyOVLLp+PJqHyAOGwX6+X/P6+X/Etfl0VYkYCoPsk7vFIlv+:GqOVLLp+BqH+Wg/yg/3YCUsk7vFGG
- TLSH T14F25E4B0901BBCA6C6E190F8C44572F2995C2F63EE34BACBF5D57A1D3B35A814928335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000d00000002ad99-2.dat family_cosmu behavioral2/files/0x0004000000025ca2-6.dat family_cosmu behavioral2/memory/3452-397-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000d00000002ad99-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0004000000025ca2-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/3452-397-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\da.txt.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\.version.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Transactions.Local.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Numerics.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Sockets.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationUI.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Primitives.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\EnableRevoke.rmi.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoDev.png.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\PresentationFramework.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_cc868d12f452742f357f0aecbdc54185_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2397528088-2630719772-1129911217-1000\desktop.ini.tmp
- Size 992KB
- SHA256 c9e01db896cbe6a9877686b017029235eef13fbb3f4cee237c6292c1075c5ea1
- MD5 873090210e3f7fd4852c451638c4d616
- SHA1 024827823d4e1cf0a6d3be4ddc7d8d52a7ab5af0
- SHA512 a40fc5c0245bffcd025ea9efb9f55eb3e45f770691e743106bf2b6ddbc7daea440d0b0c64a7420442fe6cd787d63180765082327eda27aa30c7f63cd28b312e5
- SSDEEP 12288:GPyOVLLp+PJqHyAOGwX6+X/P6+X/Etfl0VYkYCoPsk7vFIlvn:GqOVLLp+BqH+Wg/yg/3YCUsk7vFGP
- TLSH T10325E4B0901BBCA6C6E190F8C44572F2995C2F63EE34BACBF5D57A1D3B35A814928335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 1.1MB
- SHA256 a40f95b73cfbe2c35088c7544ac6bdc87dbb38cefd43ccf67379f8ebb1fb56d3
- MD5 1e1577beb993812c94631f09cac5708c
- SHA1 f9ee4dcbd9d54f1a5accbfc93ff87703416b0505
- SHA512 a52a3f83593670f1a61a927159b69425c75daecfc6bdee96a19e894fe928f1387b823d5394fd4cd79bcb85410926faec23223b924db054145eeb95750e2b1453
- SSDEEP 24576:GqOVLLp+BqH+Wg/yg/3YCUsk7vFGNMfSgW8:G3dcyoQF7SM5
- TLSH T16F3527B0941BBCA2C6D090F8C44776F2991C2F63BE34BACBF5D57A1D3739A810929275
- MD5 SHA1 SHA512 SSDEEP TLSH