Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 12:10
Behavioral task
behavioral1
Sample
2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe
- Size 488KB
- Sample260511-pcd4ksct8p
- SHA256 f4de108bb3fcaf4014643f0fca248f5aa61fc543b5a3265c19d0c8e43676aabc
- MD5 1a8b3ddb0919850b1c9bec38f5ba5d85
- SHA1 e06b62b07e61112c3b7b8a33f911f08834312662
- SHA512 2db79c5d7b8d36020b7a0f6ed0f5448ebf4a59bfcf0f10254ab7002fd502e3e6225ae64abea0114d3d2426777ae6679d942c6bd9a866c13afef9f969567d5347
- SSDEEP 3072:npWp6qbFBWN6wcUeGNqGdBBUhSfiK7HozIzPHvG4s6yW2UI54KC0bAuBWN6wcUe4:g1HvUfBvKhoTSxvUfR
- TLSH T137B4FA6C117BE2C7C8509BE0B9D2DCA94A14BD27D8642D691BACE365E3D123F640D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2388-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x00130000000256dc-2.dat family_cosmu behavioral2/files/0x0004000000028c1e-6.dat family_cosmu behavioral2/memory/2388-473-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/2388-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00130000000256dc-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0004000000028c1e-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/2388-473-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (3970) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationUI.resources.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Configuration.ConfigurationManager.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.HttpListener.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.Pkcs.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.Core.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Metadata.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_1a8b3ddb0919850b1c9bec38f5ba5d85_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini.tmp
- Size 488KB
- SHA256 1d53eb6a6734559207215a315a0af8087058a85ca844d2bf95b840132938fd31
- MD5 eeef85e12184faea67cccbc3a2553e7f
- SHA1 eca075e4f46850db2016997125fb1cfcb13538df
- SHA512 7eb1e3c034fba03a63bd73f7c929b9651b3700031c4a0b60b24cb934a90435ea1b5801e41fa2dbb76df0051434abe141ed325dead59ed252f8c4bf6bb1cac580
- SSDEEP 3072:npWp6qbFBWN6wcUeGNqGdBBUhSfiK7HozIzPHvG4s6yW2UI54KC0bAuBWN6wcUe/:g1HvUfBvKhoTSxvUfO
- TLSH T1FEB4FA6C117BE2C7C8509BE0B9D2DCA94A14BD27D8642D691BACE365E3D123F640D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 587KB
- SHA256 7a230b9c7e6df383f33d828ed99be0b83c7be009da6e1b0497dccf69f7a9e860
- MD5 523aa6d1b115779162a27be148c4cd79
- SHA1 d094e4d1b12923714decc2fb864cc07abbb4b3b9
- SHA512 743024f7fb1a649ec5fae3385b3ac36ddebdcebb73b972291fa6f7289eb0280f93a5228fcae81622056dec647c4972140a6e7cf458af49e6e176b941435181d1
- SSDEEP 3072:npWp6qbFBWN6wcUeGNqGdBBUhSfiK7HozIzPHvG4s6yW2UI54KC0bAuBWN6wcUeC:g1HvUfBvKhoTSxvUfWMfTinqncsWp+f
- TLSH T1CAD44D68217BE2C7CD409BF0B9D3DCAA4A14BD279C646D1527ACD366E3D122E640D2F3
- MD5 SHA1 SHA512 SSDEEP TLSH