Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:23
Behavioral task
behavioral1
Sample
2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe
- Size 61KB
- Sample260722-3decmaan5x
- SHA256 e3ecb0513a6c1db664b97667876d1ab0b0db055c9217734ae4f3289be686f898
- MD5 b586423e397ff9b7d9f4fe52f8763db4
- SHA1 62da41c191bfedfe868239bfd3cd4beef3ed8c47
- SHA512 40c3871ffcee3e20b031391bdcaefec002acb091f89c4f18141a5789029ba6d84ad415d75e81ffab56dbb7524e829df3d3519c9fc5ee5c170b4b71f2d980e366
- SSDEEP 1536:z7ZhA7FSFgC2N2ON2hmr3y3GfmK2+fmK21HLtItI:Re7F6P2N2ON2f91HLtItI
- TLSH T11A535B76162AF55AEFE103794E7C7C70AD183CE91620B7719BA9FC24A431E70AB118D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4236-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000600000001b867-2.dat family_cosmu behavioral2/files/0x000500000001b1cd-6.dat family_cosmu behavioral2/memory/4236-589-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4555) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OMSMMS.CFG.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ReachFramework.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\release.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\CheckpointConnect.wmv.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi.pak.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Dynamic.Runtime.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationTypes.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\HeaderPatterns.xml.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.Pkcs.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_b586423e397ff9b7d9f4fe52f8763db4_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini.tmp
- Size 62KB
- SHA256 c3986c6cb62292fccefe49a518ca54d1f3b6a4861baed72eb1b6629ea4fa94ab
- MD5 357a307b2ddbfafe3e3ab84cc5fee387
- SHA1 27914938fc2d6b641c2a5b5e3ebdfd5f7a1e623c
- SHA512 bc25ed9fb5f7a815deadf286ff3b326fdc0c4c869ec310c70856621fdf50348948b3f61864257721da73b7a00785ab87e4133eab0d602e295d876d0c4f6532d5
- SSDEEP 1536:z7ZhA7FSFgC2N2ON2hmr3y3GfmK2+fmK21HLtItX:Re7F6P2N2ON2f91HLtItX
- TLSH T123535C76162AF559EFE103794E7C7C70AD183CE91720B7719BA9FC24A431E70AB118D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 160KB
- SHA256 85f61988f71f570763052db4f1ff18b0249a68953d74f96021498fed8cede9ed
- MD5 00a47019dc4422ba30d45ecb27e5a1b2
- SHA1 c6614cdd0a909671b94f0db3637cd56b8c8756e2
- SHA512 92a5189332c012dba58d11e1f8e4896c8bf36ae2b9ea69aae084aeb82be259f4d2ce68c30a6688dc4b8cb5fca89fc4a86316f45462034b0be85bd5696bad1c2c
- SSDEEP 3072:Re7F6P2N2ON2f91HLtItn5ZMfTiu66I3UwqSsMBlsWb4A+v:0FjQ9oMfTinqncsWp+v
- TLSH T19CF327603C6EF664CF8413796E6B6E83D304398A3D19CE7266B5A9E39138DB10C574E2
- MD5 SHA1 SHA512 SSDEEP TLSH