Analysis
- max time kernel
150s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 04:03
Behavioral task
behavioral1
Sample
2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe
- Size 496KB
- Sample260415-emccmaet5j
- SHA256 ba659189940c05cd24d09e62c995be84014446f32a75f9d4ec5a6c7b775f7077
- MD5 6cc7eae314baa7b568b32f07575dfb17
- SHA1 eafefb77bdf4eae41e47d7166ed5f12e400bcad3
- SHA512 a9461f0bd59cdd48363b38343234f60950433fb8b991687de0b9a7c2c6471c8d20da20f119b2255ae38da4d32ca5bfe4f4c286b7c863e0da20946c724e17c045
- SSDEEP 6144:0HxJMZiJVLfZ+pLQnrSKdWxCbOnvQB4IbXSMx8QO3:GPyOVLfZoIW7Gw
- TLSH T1B7B46DB0485B7CC1E2E182F5951232F21E52AB773D74FED8E0C2BA5D77369A419183A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2928-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000700000000d3e6-2.dat family_cosmu behavioral2/files/0x0005000000029024-6.dat family_cosmu behavioral2/memory/2928-493-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Custom signatureDetects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/2928-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000700000000d3e6-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0005000000029024-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/2928-493-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Configuration.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\initial_preferences.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.IsolatedStorage.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\vcruntime140_cor3.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoBeta.png.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\7-Zip\readme.txt.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.TypeExtensions.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WindowsBase.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationClientSideProviders.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tracing.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Xaml.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationClient.resources.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TraceSource.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_6cc7eae314baa7b568b32f07575dfb17_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3119821332-640943685-2562343641-1000\desktop.ini.tmp
- Size 496KB
- SHA256 187d82a733c43c60e3cffb60fb7962e26a46ed106cf5255956dda634f229fa8b
- MD5 965cf75bdea178977ef27939e7e9c1e7
- SHA1 576c94abd565fb1f0e291f74b26a4534315b5914
- SHA512 c3719eeae213337e269b97d06de19139b94207216843438cbff98c972628641d0cb18a8be6044c47806d289134c0c58b7a68ead5ae75761fdb92fb615ffaee35
- SSDEEP 6144:0HxJMZiJVLfZ+pLQnrSKdWxCbOnvQB4IbXSMx8QOd:GPyOVLfZoIW7G+
- TLSH T13CB46DB0485B7CC1E2E082F5955232F21E52AB773D74FED8E0C2BA5D77369A419183A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 595KB
- SHA256 fc2bb8425ca51e9d1c07b906cb81e6edf03cc5a04056f768bc24f920489f6339
- MD5 ffdb85d275cf087c4a0cef648c29dc33
- SHA1 505cb27f4819435364b8df4b18e2d67741b3bbd5
- SHA512 756f061bf516d2c14211e3cbe363a68815d7b07b9d6600536a6c350e1b2a8671c68343acd46d98e6bbfdd8ffacfd846967a8a87fba11f95191e9d9569a986807
- SSDEEP 6144:0HxJMZiJVLfZ+pLQnrSKdWxCbOnvQB4IbXSMx8QOvMfTinqncsWp+/:GPyOVLfZoIW7GoMfunbsW8/
- TLSH T1B3D4A1B0585FBCC1D2D082F5955332E20A526B773D78FEC9E1C2B65D773A9A4081A3A3
- MD5 SHA1 SHA512 SSDEEP TLSH