Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 19:43
Behavioral task
behavioral1
Sample
2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
- Size 96KB
- Sample260723-yfap1ach53
- SHA256 6531e23e6a49f115887100515b1a7db5548394b1b781da1f31fc8c88f74f413f
- MD5 d1dbee08634bd50fb0ca1936f76b18f9
- SHA1 49f584bd0a27fe2b6b75ee0043f9f6e3f96db342
- SHA512 4bd37d4ccb8267818428e45adda7ed01056e875130f030ac1a73144c314639d9e45081aa048047bc2b3ad0188ba441b00014caa802594b6e1f9070df75bcbadc
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vAzWzK+SNjQRkWLL/:W7ZQpApkNcak
- TLSH T1D3A3F71DDBF300D2E35A2538348AB02E55B2FAD537EDDEB97652B8B94CA5CB0160058F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f000000016cdf-1.dat family_cosmu behavioral2/files/0x000400000001b1ed-5.dat family_cosmu - Renames multiple (4296) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationProvider.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\7-Zip\descript.ion.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Specialized.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationFramework.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemCore.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Handles.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Annotations.dll.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_d1dbee08634bd50fb0ca1936f76b18f9_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 96KB
- SHA256 631d41b21df0faaeebfdade8d9f34414f3a47a770d95fbcb1d0067231362ed3e
- MD5 0ff07c1178b188661e5ec2ee0674c253
- SHA1 4794b86764ba75e0764926e748d4da06d42f0cae
- SHA512 86f1f61f080f59808e5b5b96de9b51acaf96d10cd220b7bc777aa7befb313121c00513421b7d4c84e2204ed16b25c7d904cc3746cbfc4c5e6ebc8a6f99168437
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vAzWzK+SNjQRkWLLy:W7ZQpApkNcax
- TLSH T1E2A3071DDBF300D2E35A2538348AB02E55B2FAD537EDDEB97652B8B94CA5CB0160058F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 195KB
- SHA256 3b160bc4813ef88f9fc3e2b05bfc1dde2f7f15981a4cf5a0cce8ab121c8b09ae
- MD5 8a9d68ab361d311b70c5b27a8556a278
- SHA1 b209d7a2f9abe12341e8f9ef91dd432883388521
- SHA512 4cadeb6f272f365ba0d8324b0131d2c84644cdb507ee4d80f5921d1ae67d7b3c5e587fcb1ca73fd5088d5ec9167b190c523434db4262a132383a634d8151c297
- SSDEEP 3072:6QWp2ca/5ZMfTiu66I3UwqSsMBlsWb4A+D:WEcgMfTinqncsWp+D
- TLSH T12814F6107DAEF1A0CB442239695BBE8F8201798B3EDDCD7676A225E38538DB10C574E7
- MD5 SHA1 SHA512 SSDEEP TLSH