Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 19:05
Behavioral task
behavioral1
Sample
2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe
- Size 3.9MB
- Sample260506-xrmy2agy5w
- SHA256 9dbcaa3018e8bb3fd62ccc1ba2f47b9c4c1db87b0bd999f206763a78b407f3c8
- MD5 11e17185458b8345002d8ae7de5d65d4
- SHA1 43581076b29b655b160716b15d5a7272c1634134
- SHA512 1dd23837ae85466cb699966c1d73e7994e273f55ed31bdcb5585a0418274dcdcdc44537548a66ca0b253bc3418b03a13fccb5bfe747cd8193e1b3098ab696780
- SSDEEP 49152:G3dJBwy3gPcMPdQCDYtRsiX3IaPyupWaDy3lHa/Q3Hx4FDATud5zaYnnlLV05+VW:QdJBwyQV7YeKldhGpF
- TLSH T133167CB0512BFCA1C2C681B4D1A476F4685D7EA3EDF8EED3F5943D1C3A34B816928624
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x0012000000026154-6.dat family_cosmu behavioral2/memory/4928-13-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x001a00000002b4c0-15.dat family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0012000000026154-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4928-13-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x001a00000002b4c0-15.dat INDICATOR_EXE_Packed_eXPressor - Renames multiple (1090) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2328 Zombie.exe 3180 _FlickLearningWizard.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Memory.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore_amd64_amd64_8.0.1525.16413.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Expressions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.Unsafe.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp Zombie.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.RegularExpressions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Cng.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4928 wrote to memory of 2328 4928 2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe 79 PID 4928 wrote to memory of 3180 4928 2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_11e17185458b8345002d8ae7de5d65d4_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\_FlickLearningWizard.exe"_FlickLearningWizard.exe"2⤵
- Executes dropped EXE
PID:3180
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-600123060-2148212387-2211176695-1000\desktop.ini.tmp
- Size 3.0MB
- SHA256 ec79f7dc4a8e5b830eb2419312a9fc96ed77dbdb9a7597aaf76b1829da25be7e
- MD5 1981873c2c51babb331c173866f6e3e1
- SHA1 da38b1ecab8088b4cd72737a0047653b74d6c28d
- SHA512 8691934100a45031d4c756ec31c1750baee42945993b3700ab503f3c5189d4f9e89aa1d064b50cb058acebf659eab39e54386904547b6eb3d02c6cab651f4ed8
- SSDEEP 49152:G3dJBwy3gPcMPdQCDYtRsiX3IaPyupWaDy3lHa/Q3Hx4FDATud5zaYnnlLV05+Vw:QdJBwyQV7YeKldhGp
- TLSH T143E59CF0626B7CE1D2CA82B052A536F968527BF77DF8FED0C5D8311C2B64B816858724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_FlickLearningWizard.exe
- Size 906KB
- SHA256 d2072ffe011341ec2a3c4af9f93b06deffa92fa05120c45dbb3ad5635f3e57b1
- MD5 84ff6c209447a056e22a29806bfa2c96
- SHA1 21190928955094c44ad996f26c801b46437809cc
- SHA512 6493dfbe43887e6a588ef067960ddb9e9798e07bb14fd73abf99acc5ee63250858c86d70a926f009f466bf6fedb7ca43bbecf7fc2433e47704527c2d0b6b01d9
- SSDEEP 12288:/qHyAOGwX6+X/P6+X/Etfl0VYkYCoPsk7vFIlv:/qH+Wg/yg/3YCUsk7vFG
- TLSH T129159F20D127CCABD210A03CC945E6F5EAAC7C50C718CBE7B615BD2D7936A964E7C0B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 3.0MB
- SHA256 23cfdc7163c99d4af7bd56eefef8557bc34912c60ab1ea5ebba22581b1bb1336
- MD5 656906024db4348560f056150dba437d
- SHA1 2113fa8f339b63e8e046923dbc8191f5f96bffdc
- SHA512 a6eee40dc8688ba6f6e47a4db5fe7025bdebff14b048c85f7655e27d212a85bbc7f41cf9ebb82b1cb82f93c5c9f06e15a01481a88c42b880eef617b92fdebbbf
- SSDEEP 49152:G3dJBwy3gPcMPdQCDYtRsiX3IaPyupWaDy3lHa/Q3Hx4FDATud5zaYnnlLV05+Vd:QdJBwyQV7YeKldhG8
- TLSH T1C6E59CF0626B7CE1D2CA82B012A536F968527BF77DF8FED0C5D8311C2B64B816958724
- MD5 SHA1 SHA512 SSDEEP TLSH