Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:09
Behavioral task
behavioral1
Sample
2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe
- Size 68KB
- Sample260722-25am3swfnd
- SHA256 0cf476c9548ca945167475e8bbc54f6d088fb866f3b88b2ae2de1201a709c836
- MD5 de8129b510f5bde9e7796643a8d63b02
- SHA1 c610332fc92ad2add4eaf7f456ff6c8739834d78
- SHA512 afefa9e9ee454bdb51cac3f4bbe3ba6753bdd317783be4cde7fe92319a6038655c2bc1cf14a0f2d3560654787e87372b151fb2fda2138b89eb432dbdb02ff054
- SSDEEP 1536:z7ZhA7FSFgC2N2ON2vcGUcGnuNuYQNQNKK:Re7F6P2N2ON2vjUjnuNuYci
- TLSH T1B4637D0E3B069DB2E53E1B345C5B58AC087A28447EB4FF862B3AC0D799743D5852A71F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/1408-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000a000000011390-2.dat family_cosmu behavioral2/files/0x000300000001b1d6-6.dat family_cosmu behavioral2/memory/1408-554-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSSPC.ECF.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ml-IN\tipresx.dll.mui.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Sockets.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationFramework.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\Logo.png.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMeetingReqSend.nrr.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Windows.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_de8129b510f5bde9e7796643a8d63b02_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 69KB
- SHA256 1feef425d7646b851655538b0528e35656794a6b41119e997875c11b3e1827d9
- MD5 3093bdd8680749304d1e4f973a74bf66
- SHA1 f64e1c1cddecf1767ae1a00da81c30f1a9619084
- SHA512 6cd1cbb312ea1d7fff53d749d1758f1ad27f5ae9c5a507f73943a465d6748eb4001c75c2da74083b63fd822de8b9aeeb1be1b3f0ad020c35a7230745f6e3ba06
- SSDEEP 1536:z7ZhA7FSFgC2N2ON2vcGUcGnuNuYQNQNKN:Re7F6P2N2ON2vjUjnuNuYcV
- TLSH T17D637D0E3B069DB3E53E1B345C5B58AC087A18447EB4FF862B3AC0D699743D5852A72F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 ec6322b1caac137da475d01910aa9b39968f746a3bf7301a6d789eba81d6c704
- MD5 05f79c55d15733320dae9d88889d7b44
- SHA1 f2f45234b48e282c36d15ca186b3086131db0f91
- SHA512 9b8f51ec559052004fdc7f1eb17b00a886ec4c58c56732cb13aa425ec8785490a502d5d1e66bf8fa7fd9b037375cc712fbe0df7d0c789ffb811441ea9dfcbd76
- SSDEEP 3072:Re7F6P2N2ON2vjUjnuNuYc95ZMfTiu66I3UwqSsMBlsWb4A+Y:0FjmoDuNuYc1MfTinqncsWp+Y
- TLSH T105F34A213DAEFAA0CF5813396D5B5E878315398F3C69CE82767641E3813CA850C5B5EB
- MD5 SHA1 SHA512 SSDEEP TLSH