Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 19:43
Behavioral task
behavioral1
Sample
2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
- Size 96KB
- Sample260723-yfap1ach53
- SHA256 6531e23e6a49f115887100515b1a7db5548394b1b781da1f31fc8c88f74f413f
- MD5 d1dbee08634bd50fb0ca1936f76b18f9
- SHA1 49f584bd0a27fe2b6b75ee0043f9f6e3f96db342
- SHA512 4bd37d4ccb8267818428e45adda7ed01056e875130f030ac1a73144c314639d9e45081aa048047bc2b3ad0188ba441b00014caa802594b6e1f9070df75bcbadc
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vAzWzK+SNjQRkWLL/:W7ZQpApkNcak
- TLSH T1D3A3F71DDBF300D2E35A2538348AB02E55B2FAD537EDDEB97652B8B94CA5CB0160058F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000c00000002432a-1.dat family_cosmu behavioral1/files/0x00060000000217ac-6.dat family_cosmu - Renames multiple (4903) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WindowsBase.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\INFOMS.ICO.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDREST.CFG.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationFramework.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\amRenderer.js.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini.tmp
- Size 96KB
- SHA256 9bdee723992af6d6bd030160cff3ab14d5f4f7a8257bed648c3d0fc224831eb2
- MD5 3e13d996ecd2523cfdd6aa7841bbe8bc
- SHA1 aa9fa383eda8fd66c5cb00614616a558194761fd
- SHA512 3e9e6237ab6fc27d28f88cbf199cd0a4863d2afa07b8caed7b178b30acd5ed237fd5805213989bfc30ddbe9859d48b446125e008d228f15e7b71b20990390879
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vAzWzK+SNjQRkWLL8:W7ZQpApkNca7
- TLSH T199A3071DDBF300D2E35A2538348AB02E55B2FAD537EDDEB97652B8B94CA5CB0160058F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 195KB
- SHA256 6dd84904f5ede83fae2b688c06344a4a3670f42a186055596d25eb6080f04088
- MD5 e972d0ceb7d79993695e331e292b8987
- SHA1 3ff472f0d3265b1b919ffadb1520dc626c838714
- SHA512 349733f2dd863f09ac2a05c0237260e44b0c2fdcbe3281ff6dc5248b123c627f583bc7eba87b306cc725800ef13342339ef39e25639c4b148f4649a5ebf4b070
- SSDEEP 3072:6QWp2caY5ZMfTiu66I3UwqSsMBlsWb4A+D:WEcdMfTinqncsWp+D
- TLSH T1E314F6107DAEF1A0CB442239695BBE8F8201798B3EDDCD7676A225E38538DB10C574E7
- MD5 SHA1 SHA512 SSDEEP TLSH