Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:14
Behavioral task
behavioral1
Sample
2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe
- Size 90KB
- Sample260722-28clvasva1
- SHA256 9e1bad6d50832c9ada2f2100c6821c7c6b9634c9de28dcb61437d8a2309866aa
- MD5 d10342bc86358abd5e8c8d43fc07d8bd
- SHA1 64c8114b22146c3d9f4b0b631a80dcdb1e281998
- SHA512 9fe38aa40b3c2b7c4420f6ae3b5c4b815d31fb8e62a13c72cbc6934ea079d1914ce6b306874d0f29d414add1ade4c11f7e78b1ed861e3a3e314b569f3d5ee0c8
- SSDEEP 1536:z7ZhA7FSFgC2N2ON2DRxSFgC2N2ON2DRWeDeD:Re7F6P2N2ON2DRx6P2N2ON2DR8
- TLSH T12A936C3D3A16FDE2D23E12B0A42354B48CB6BC697DB0FED2532209B85525BD15188F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3436-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000d00000001b89b-2.dat family_cosmu behavioral2/files/0x000400000001b1cd-6.dat family_cosmu behavioral2/memory/3436-557-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mt-MT\tipresx.dll.mui.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Xaml.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hi-IN\tipresx.dll.mui.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemData.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationProvider.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fr.pak.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationFramework.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\Welcome.html.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_d10342bc86358abd5e8c8d43fc07d8bd_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini.tmp
- Size 90KB
- SHA256 7733e302ebf1530c54f5f92bad0a4b422b27c9595b6ed919cf19e2bdc3c6fbc5
- MD5 4726afb7c15c8dc983562a46dc6e75e6
- SHA1 6ce969d8d5347f536693065a5f244225034f837b
- SHA512 687f02fea94bc79f5f5b440c7fbd2ab6235b359ce938e12e31dd2e36d501daf4049790604d33d09c8751631f18cf4d24a1919833967d7e7a8c6d8392fe0c42bc
- SSDEEP 1536:z7ZhA7FSFgC2N2ON2DRxSFgC2N2ON2DRWeDen:Re7F6P2N2ON2DRx6P2N2ON2DRE
- TLSH T111936C3D3A56FDE2D27E11B0A42364B48CB6BC687DB0FED2532209B85525BD15088F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 189KB
- SHA256 5b75edad7171b67c5f6f3057a09c0a9e282601f5e617f487497b94a07f31ca9f
- MD5 c206cfd806ef72071948129db546f141
- SHA1 239312ef8e3e1fb5786144508d6f2caa7a986609
- SHA512 f7da0fa726477ec8fbb7aa3b6cfd1e7e6e71df1724f1fd691d112accb1eab7cec99fa0b52615019427704555c3e396974db57e7d85678c02d2fc6195e019d5e8
- SSDEEP 3072:Re7F6P2N2ON2DRx6P2N2ON2DR95ZMfTiu66I3UwqSsMBlsWb4A+s:0Fj2RFj2R1MfTinqncsWp+s
- TLSH T146143A203C6EFAA0CB581378A8175E83C6157D9F3C69DE82627515F3913CE910C9B9E7
- MD5 SHA1 SHA512 SSDEEP TLSH