Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 02:56
Behavioral task
behavioral1
Sample
2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe
- Size 3.1MB
- Sample260505-dfapsabw2l
- SHA256 663965c44f2b120969a9df5dbfc5324e7d77311ca2bbf3ed1265d029d95e9c9e
- MD5 b8cd24cc6b728c3e668b2c48ee45c559
- SHA1 4b21c8292392e23a044c1fb9328cc749bcd2c256
- SHA512 5e950989fb1965315ff3d819a51f976a11cbefb67fb769c1b1c4a753b7d867027b3facc98b2129a86f76d730e798d432d21658d2328c96b75003822505d1f2a4
- SSDEEP 24576:GjvAfSkXXHsfCbBLetE7e5W2d1JyB/0MzxQ2UKL7isSAuo8698aHING:GjIfSkXXPLetEBZuop98aHf
- TLSH T1CDE53C2E176641D3E0589338B0EBB35DF211FC0ED4E538887BA5B3297B55F42B616A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4652-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral1/files/0x000b000000023759-2.dat family_cosmu behavioral1/files/0x000800000001e6c7-6.dat family_cosmu behavioral1/memory/4652-198-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral1/memory/4652-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000b000000023759-2.dat INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000800000001e6c7-6.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/4652-198-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1002) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.Common.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebClient.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\7-Zip\readme.txt.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_b8cd24cc6b728c3e668b2c48ee45c559_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-721190819-434563495-2007910846-1000\desktop.ini.tmp
- Size 3.1MB
- SHA256 1fab7ff8e922182eda2f22c5fe9ca1174c6b7cc7088afa531f9bf3312d086f43
- MD5 8bcff3926511f09496e8d1d6122d6790
- SHA1 c2726c6335805ef7450ece01974d7d67fc474d1d
- SHA512 38d9a05e8820a5b7a1f63879ce18513859de3af57fd2f362feeb4df14f39ae93592f62a8a9641da2ae66a72ecb481ecd833027fd519c14544af4d48f970c2448
- SSDEEP 24576:GjvAfSkXXHsfCbBLetE7e5W2d1JyB/0MzxQ2UKL7isSAuo8698aHIN5:GjIfSkXXPLetEBZuop98aHI
- TLSH T1AAE53C2E176641D3E0589338B0EBB35DF211FC0ED4E538887BA5B3297B55F42B616A32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 3.2MB
- SHA256 db8cc178d91a60a410df2b1e57505d8fa6623b7bf0b94cc33039614975aebd86
- MD5 e3c631eeda8c9255c9978613a2578f71
- SHA1 894c5654d3134d97dc3b4c46956bf1f4956fbc7d
- SHA512 68b4bd9b7faeecb4173a53dba897a805bdd81d51950f94998d668938f53b593fc2e2e0404d439a3364da457ec0de77614bf2d9978fbca1286268c6d01bedbe43
- SSDEEP 24576:GjvAfSkXXHsfCbBLetE7e5W2d1JyB/0MzxQ2UKL7isSAuo8698aHINPMfSgWv:GjIfSkXXPLetEBZuop98aHSMq
- TLSH T17BF54C2E176540D3E0589338B0EBB35DF211BC0EECE568887BA5B3257B55F42B617A32
- MD5 SHA1 SHA512 SSDEEP TLSH