Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 23:34
Behavioral task
behavioral1
Sample
2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe
- Size 63KB
- Sample260722-3kl12ssxas
- SHA256 7baeca637334b01d3045d03fd7755f9fe89afc7951759f5bb38b69d1c7bb9f21
- MD5 95416b1b6aa92b4a67d1c610640310c1
- SHA1 60d60ae7a09d2288ee29cad1084ba6b139d191f8
- SHA512 67eb2d5bc7dc5188f3e4a1a8796f43434451f5668be29feda48fee42f79471f9fe3130d1e8fef33318bb7c0316eb37ad781799e7b077c99ba0a8ce03aeb39a81
- SSDEEP 768:KI7BlphA7UbSrbhSK0s7OuU2NxAONxA/od+Zbtsmxmgq:z7ZhA7FSFgC2N2ON28mxmgq
- TLSH T173538E2E3A19D9F2D26D02705467B4BCC8737424BEB0FED293667D781562B908428A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4804-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral1/files/0x0003000000023387-2.dat family_cosmu behavioral1/files/0x0006000000021914-6.dat family_cosmu behavioral1/memory/4804-567-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (5058) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlook.nrr.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\PresentationCore.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Forms.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\chrome_installer.log.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Extensions.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMeetingReqRead.nrr.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorrc.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationTypes.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Channels.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDRESTS.ICO.tmp 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_95416b1b6aa92b4a67d1c610640310c1_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3053180483-1881419501-3594244048-1000\desktop.ini.tmp
- Size 63KB
- SHA256 39c0483abd19cdcc163f587855881e4f0fbc6f930a925b79b22f2737af529c2d
- MD5 30b81e9cb25fc04897e7ec3c70113654
- SHA1 ca59aacab3ee7ba96612bbc5edcdafb92619dbb3
- SHA512 5ad609a7a91d421d92838ec6301a9000de5350a6c692f3ca88ee8152c74bc0efe404f7e782e99aa00a63af01582254e87ee7f3dcc3252bc10c9f9d39ff189856
- SSDEEP 768:KI7BlphA7UbSrbhSK0s7OuU2NxAONxA/od+Zbtsmxmgll:z7ZhA7FSFgC2N2ON28mxmgP
- TLSH T1A1538E2E3A29D9F2D26D02705467B4BCC8337424BEB0FFD697667D781561B908428A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 162KB
- SHA256 dafcd04f7c823d68685f7655256ea127a87ba025a8983dbc96f4269b08a4d84e
- MD5 16477f4d12c22455e5875b448bc272f7
- SHA1 ef1b56c83a3a19b10e09f0237b8b620aac10f087
- SHA512 4ca538e4804258155edfcb6fb3aff957f23c7891300a97e1d65f9bb15d4691b835493c8c7290096fc07ebd64da6783e5e3fbe450786014f7e1020fa177097949
- SSDEEP 3072:Re7F6P2N2ON2v5ZMfTiu66I3UwqSsMBlsWb4A+T:0FjaMfTinqncsWp+T
- TLSH T19DF307607CAEF6A0CB4813796D5BAE87C205398B3C59CE8276B535E3513CD910C9B4E7
- MD5 SHA1 SHA512 SSDEEP TLSH