Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 02:56
Behavioral task
behavioral1
Sample
2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe
- Size 392KB
- Sample260416-dff7kaew7p
- SHA256 b818c443585bdd1fb747876028606fa2d7fba73956886ddb5514bfb00e5dbfc0
- MD5 ee075a0aa73ffa6faf0484fb18d3a839
- SHA1 c793b67f824359d5212d9d3e633f9f382dcfcaa4
- SHA512 c4079dcebcfe4a3efc222904718280b2c21a0a4bcab80cbc57d7a09e2fd780da8309473c29d865e647f200543cfb285a029ed35c5d4dcc07efc53e3ff00ccf16
- SSDEEP 3072:npWp6qbFBWN6wcUeGNqGdBBUhSfiK7HozIzPHvG4s6yW2UI54KC0bA/:g1HvUfBvKhoTSC
- TLSH T1F484D97C117BA2C7C8509BF0B9D2D8A94A14BD27D8642D681BACE365E3D122F740D2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2232-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x002500000002b183-2.dat family_cosmu behavioral2/files/0x0004000000028c1e-6.dat family_cosmu behavioral2/memory/2232-532-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/2232-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x002500000002b183-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0004000000028c1e-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/2232-532-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7-zip.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\eu-ES\tipresx.dll.mui.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Accessibility.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\PresentationUI.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PenImc_cor3.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn.pak.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ReachFramework.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Primitives.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_ee075a0aa73ffa6faf0484fb18d3a839_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini.tmp
- Size 392KB
- SHA256 fd057b0268bda134ae045edf1bf071d867260793c0d6f5f3cdf19cc7887491f7
- MD5 71ab46b17f4444931e2d7d316d98c1f8
- SHA1 891b3425045980280e11b5b9d7e7d6e4e8db8359
- SHA512 28e515ea1936c904876642cbe0e5e80fc8a7c80324affe0b116c0df15c1274bd5e5bbd13d0d5be2b58ffe9145ff9c4d543a6f9e1babc0d2482cbb43ec8a68b16
- SSDEEP 3072:npWp6qbFBWN6wcUeGNqGdBBUhSfiK7HozIzPHvG4s6yW2UI54KC0bAh:g1HvUfBvKhoTSY
- TLSH T1CF84D97C117BA2C7C8509BF0B9D2D8A94A14BD27D8642D681BACE365E3D122F740D2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 491KB
- SHA256 fa567aa9ed4bcac30405df81d74add7113177e4e8c31e9c79b644380c8cabc06
- MD5 9c18ca7c518562813c17ae57cdc6f7cf
- SHA1 a3ca10e0897f3a6927d36643909ec3330c36d7c4
- SHA512 9afb856d2080f8005073304d951d7b700df9b5187a44910a7c17f0a0822ccee9b86e6665f91038b90a89c5a0ff2f3e16b03df257f679baa1da1162dccd9017a2
- SSDEEP 3072:npWp6qbFBWN6wcUeGNqGdBBUhSfiK7HozIzPHvG4s6yW2UI54KC0bAu5ZMfTiu6R:g1HvUfBvKhoTSVMfTinqncsWp+W
- TLSH T121B44D68117FE2D7C9409BF0B9D3DCAA4A10BD279C645D2527AC9366E3D122F680D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH