Analysis
- max time kernel
149s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 02:44
Behavioral task
behavioral1
Sample
2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
- Size 49KB
- Sample260716-c8l3vae12w
- SHA256 32620b904a9954ce3a1dbb34cfb9ac548cad41caad3f0625f47100d27ade784f
- MD5 b71fb136e2bf1eb2e80d1a6fac2891e9
- SHA1 e3f86a38cd375f865f5b2ad8983942704650181f
- SHA512 67b0b7cb008654417e2cd7e10c96e8d867f89460853b07888cafbdfd96acd87172ca87fcea16d1a6ada0fc0795bf0a2a363b54b4e57dfd354ce29b45e3716b8e
- SSDEEP 768:p7BlphA7dASbSLJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfwknk1:p7ZhA7dAxJJ7T4Mak1
- TLSH T13D334A0EDF64CC13F12A6536EC4B10BD8B3A15CC7B1DDDB6B265F9C98DA47A0EA0105A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x0008000000019cc1-1.dat family_cosmu behavioral2/files/0x000600000001b1c8-5.dat family_cosmu - Renames multiple (4559) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClient.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\ACTIVITS.ICO.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTEL.ICO.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMailRead.nrr.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CONTACTS.ICO.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.Design.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationCore.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTLPERF.H.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_b71fb136e2bf1eb2e80d1a6fac2891e9_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.tmp
- Size 49KB
- SHA256 fbbb1bbbcb9e2833e00679ad690c3184dffbd10877a0cc7b46fce8776c0a0721
- MD5 b14cd39d4edab0bdf7149b52e949723c
- SHA1 1a7ed0dced7241155af34759bc5841c16a900118
- SHA512 6b3879028c444c77261d9cab3012501e549fc6493b632d0afb75014f8dc7fd4fb0e9943104b5a99ebe630568231516342ddadd0a802e46611274b4b50fd24f80
- SSDEEP 768:p7BlphA7dASbSLJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfwknkZ:p7ZhA7dAxJJ7T4MakZ
- TLSH T146334A0EDF648C13F12E2536EC4B50BD873A15CC7B1DDEB6B265F9C98DA47A0EA0105A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 148KB
- SHA256 719b29666e947b124ba3cd17dbf1af9819360f6b8f9ee4379e7fefeaff66242d
- MD5 49fa17539946258a808c86c952f6b01f
- SHA1 29954b4c61844250e6059f8ab75cb05c028c0175
- SHA512 40be739a17fcece4c333897a86818d78fcc555908e65add87d062e74586cc518ce77c7d90d5a44babc376e4ae2ab88417c453e9be97ac3f500d8bd96a6c3218a
- SSDEEP 3072:Te76xUMe5ZMfTiu66I3UwqSsMBlsWb4A+j:SeGM4MfTinqncsWp+j
- TLSH T112E30610BCAEF661CB482239AD5B5E83C315398E3D4ECE9272B575E3893CE910C574E6
- MD5 SHA1 SHA512 SSDEEP TLSH