Analysis
- max time kernel
150s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 21:35
Behavioral task
behavioral1
Sample
2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe
- Size 824KB
- Sample260510-1feease151
- SHA256 b8f5b869c21fad4200c8e1e1dc59f024405c1862f959a09e357a8bf88cd80265
- MD5 2039536ea2ae18e0fca774e6687b5e3b
- SHA1 c1f2dfd988326b8a032ef58d83fdd2900a71454b
- SHA512 f403e087d9f41f7a9fbafd3b29cfdc99e9aa4c224233be229ca6a21286bb24fbce7166b9595e28436296a8f6d6f0f3b791761e2924bae7e5ebf3c95ad38fcd35
- SSDEEP 12288:GPklj05a55PJQHbuZ/kPlWShi8wQjKzdv0reiio:G25QycrRwGKarPx
- TLSH T189057B042057E642F8A447F569E3F4C80B10BE26B85CEC2462D4B676A6F126F6F1C7B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4884-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x001a00000002b4f3-2.dat family_cosmu behavioral2/files/0x0004000000028beb-6.dat family_cosmu behavioral2/memory/4884-409-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4884-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x001a00000002b4f3-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0004000000028beb-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4884-409-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationProvider.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Permissions.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.ZipFile.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lt.pak.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\desktop.ini.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ReachFramework.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Printing.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationCore.resources.dll.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu.pak.tmp 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2039536ea2ae18e0fca774e6687b5e3b_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2122505878-652277452-2375749442-1000\desktop.ini.tmp
- Size 824KB
- SHA256 aa4341d1a23c0a7316c36edc3b5a5996616fabe2748aec76f757cd07a3825e04
- MD5 0d463b953a7b19fe18eb3037e0c26a7f
- SHA1 e23e6b560f852ddcaa2cd5e558d590fa8c57b5c4
- SHA512 9ed90e648f4d1eb2a72e085a7fc47dc4aad89dfbf56aca95b2c5e4a403cad09e84f6ccdcee1e33522c1ed3c212251a4f9bb0d4c93f10f8f10a567a176de58e02
- SSDEEP 12288:GPklj05a55PJQHbuZ/kPlWShi8wQjKzdv0reiij:G25QycrRwGKarPS
- TLSH T1FF057B042057E642F8A447F569E3F4C80B10BE25B85CEC2462D4B6B6A6F126F6F1C7B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 923KB
- SHA256 0e15ff6ee10ba8669d251676eced8d9471d6b25c2ff264f429f8a16606e938e0
- MD5 b8ff4cd25bff04460fad72ede73092e8
- SHA1 abb6fd037a930fb0f6d1cf7b9dd3d99adc51276f
- SHA512 22f250fcfb128cc4072efa1fbebeecafe52d165e56be8d8c0dd7c37fc745c6461f27760f11b071ecb03bab20091b94024a6c2e7347323832d59c0a49dd1c8899
- SSDEEP 12288:GPklj05a55PJQHbuZ/kPlWShi8wQjKzdv0reiiXMfunbsW8L:G25QycrRwGKarP6MfSgWg
- TLSH T1B2157C00246BF642F9A407F569E3F8C50700BE267C5CEC2462A476B6A2B156F5F1E6F3
- MD5 SHA1 SHA512 SSDEEP TLSH