Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 02:44
Behavioral task
behavioral1
Sample
2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
- Size 49KB
- Sample260716-c8l3vae12w
- SHA256 32620b904a9954ce3a1dbb34cfb9ac548cad41caad3f0625f47100d27ade784f
- MD5 b71fb136e2bf1eb2e80d1a6fac2891e9
- SHA1 e3f86a38cd375f865f5b2ad8983942704650181f
- SHA512 67b0b7cb008654417e2cd7e10c96e8d867f89460853b07888cafbdfd96acd87172ca87fcea16d1a6ada0fc0795bf0a2a363b54b4e57dfd354ce29b45e3716b8e
- SSDEEP 768:p7BlphA7dASbSLJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfwknk1:p7ZhA7dAxJJ7T4Mak1
- TLSH T13D334A0EDF64CC13F12A6536EC4B10BD8B3A15CC7B1DDDB6B265F9C98DA47A0EA0105A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000b0000000242c8-1.dat family_cosmu behavioral1/files/0x00110000000201fb-5.dat family_cosmu - Renames multiple (5118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg.pak.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Formatters.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.DataSetExtensions.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_WHATSNEW.XML.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DISTLSTL.ICO.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUTL.OLB.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.Vectors.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\host\fxr\8.0.15\hostfxr.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationCore.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Xaml.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-876885714-46325919-1482798410-1000\desktop.ini.tmp
- Size 49KB
- SHA256 e734a8d122f510463ea95e559bf8a07944bcb3cc19ffe49dd3a41e3da025bac8
- MD5 99409817cc6cc8c06492bda6faddfa40
- SHA1 59bac54f0830cf6b84fa81570bf94b30998dcbc5
- SHA512 e29a46cb562c8264147aa5c98f509934c092dd32ce36454ddb4bb00b11e457361a527d20404baf66b156eb4b2ae4ce0dd11eb0ede6d13a624da44e1c040485e6
- SSDEEP 768:p7BlphA7dASbSLJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfwknkJ:p7ZhA7dAxJJ7T4MakJ
- TLSH T15B334A0EDF648C13F12E2536EC4B10BD8B3A15CC7B1DDDB6B265F9C98DA47A0EA0105A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 148KB
- SHA256 bdb9cfb4a7b79b03e04247a5cdad3c4af90ee9068cf72776cf71d7b5cb572844
- MD5 0d3c3c9ac36d5077f4e7d1794087bc82
- SHA1 da345ac08df225644ccff99e3b844c4ea7091279
- SHA512 c403028fe269cd004e8414b24ce9213e192a13c06d41c21e84bc197ae21d90bf497f8271dd783cb7139064b58334d68305dc843e5d222c5c055506527edecec5
- SSDEEP 3072:Te76xUMZ5ZMfTiu66I3UwqSsMBlsWb4A+j:SeGMZMfTinqncsWp+j
- TLSH T165E30610BCAEF661CB482239AD5B5E83C315398E3D4ECD9272B575E3893CE910C574E6
- MD5 SHA1 SHA512 SSDEEP TLSH