Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 15:53
Behavioral task
behavioral1
Sample
2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe
- Size 596KB
- Sample260503-tb268scy21
- SHA256 724121bdb200224b01eee4d138c655464deb4aaabe442159e2c3d033b50224a2
- MD5 adf9c10c54638eb9dc8fd6fb31d48ef4
- SHA1 24494a41f2a9374c13fdc730394472d223d26739
- SHA512 13011c76e9350425aedc6cba48f9a8e26d50a1d7f139c61e74567d0a31d36b72a5f6d279c454cd46425a0ebc0ab0f7d29f87d0f85baf07b758bc7428d67b5140
- SSDEEP 6144:g1HvUfBvKhoTS0rRCrzdqt677DA7R/lAZ:E+JS0rRCvd26LA7MZ
- TLSH T18BD4F37C116BA3D7E8549BF0B5D2D8E94A10B926E4686D2417ACD325E3D233F680D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2180-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x001e00000002b0fc-2.dat family_cosmu behavioral2/files/0x0004000000028beb-6.dat family_cosmu behavioral2/memory/2180-433-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/2180-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x001e00000002b0fc-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0004000000028beb-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/2180-433-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsFormsIntegration.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationProvider.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationTypes.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Specialized.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\DismountInvoke.wm.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoDev.png.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationTypes.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\PresentationFramework.resources.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\v8_context_snapshot.bin.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.Client.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_adf9c10c54638eb9dc8fd6fb31d48ef4_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2122505878-652277452-2375749442-1000\desktop.ini.tmp
- Size 596KB
- SHA256 e006fabb2d69080b5b81d3f603cb08ac8d91a5d6f7de1240b18e1f4961944c50
- MD5 f73c9f050bafc482e1ad285a7075bbe2
- SHA1 42380e467e2b63abffb04918c47b276085add3b2
- SHA512 6cf2f50f79418e800973eb405ee2dd3a7fdef83447de128f16367f0a9991e696a1e141323ddb36e61265140ae68504c63466422bd41a6e70a486f3375a4b838d
- SSDEEP 6144:g1HvUfBvKhoTS0rRCrzdqt677DA7R/lAE:E+JS0rRCvd26LA7ME
- TLSH T16CD4F37C116BA3D7E8549BF0B5D2D8E94A10B926E4686D2417ACD325E3D233F680D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 695KB
- SHA256 a1310eb97bd2e0c49d2da36d1c10bf06f69ba7f7a749d0395edd71279cfcd09d
- MD5 d9e2bad1827f0be0a06856d66ed33d90
- SHA1 709be0167d5cd3c478e86e3604272c93dd5ed644
- SHA512 e50c6d8e0fec2252403786437eea8144ea615d28c62013ae389818771211053a73f7e25961fba9e3c191775ed90d11324dd9310f4809e0518efeb70eee2c2a6d
- SSDEEP 6144:g1HvUfBvKhoTS0rRCrzdqt677DA7R/lAwMfTinqncsWp+A:E+JS0rRCvd26LA7MwMfunbsW8A
- TLSH T153E42468116BE3D7D95057F0B5D3DCDA4600B926AC68AD2427ACD366E3D223F680D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH