Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:13
Behavioral task
behavioral1
Sample
2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe
- Size 2.4MB
- Sample260728-15kmlscb49
- SHA256 0c651068670fad152cb0aab087dc954f976c15b878ddca46fe276497625313b4
- MD5 b8bd73a280d8b0c20756c33a6a80cc8f
- SHA1 fd1cc0a7807ab0524e67ec4de322b47a3e8bf006
- SHA512 eff4610a7a3a786bbd4615f8e6e6d392e469f393237b322c4763dd47a0959263cafe7bf4bf52e45974d1fa3f099d4d117387a1d30b45579d8871112b66c0e861
- SSDEEP 49152:iFIpI2IOXi8rfgEnC7EWVBqkzT3ltO/Ii2uRqpsHiWAz:iFxOy8rfoVBBv3f/NWiWAz
- TLSH T11DB5337E55CFB4C7F3FD11708543368D6D1AB82EAEE5B8B239A234DA3846EB05114287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x0008000000016b4d-1.dat family_cosmu behavioral2/files/0x000400000001b1ed-5.dat family_cosmu - Renames multiple (757) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\quz-PE\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\gu-IN\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ms-MY\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.CSharp.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\id-ID\tipresx.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_b8bd73a280d8b0c20756c33a6a80cc8f_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 2.4MB
- SHA256 3c73734fa500c13a1befc770163429a64885eabf5c10a4613911bc35e0104ea4
- MD5 a668befb9f12f446afe74f61de22283e
- SHA1 1cc3501a8aa2b5cfc398aa56f7a8d27706b789ce
- SHA512 8b2e9f8ecf529c9124fc434451e8894a2d7e8dcbbeee1c2634cc939f6c9e721971979314c48af5490f152f5eb0e5d634b30e6d6bcf0f55d656eddc1987ea36a4
- SSDEEP 49152:iFIpI2IOXi8rfgEnC7EWVBqkzT3ltO/Ii2uRqpsHiWA2:iFxOy8rfoVBBv3f/NWiWA2
- TLSH T102B5337E55CFB4C7F3FD11708543368D6D1AB82EAEE5B8B239A234DA3846EB05114287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 2.5MB
- SHA256 bdf8c0e3bbc69e1a7ac8fd072a7886972dc8fff41d9b1fb9d5ec8ef9aea60906
- MD5 5c444425fbe5eb9e2c19e72968eaedaf
- SHA1 57095bca66007ff2e105adfdbd310013a7f6f503
- SHA512 2e0c47e8979bdee494e71f1a4dcb7cc3695dcb9ce9eff7833507a9549537620584b1ade17c598310105b38e069ac19c6ad8837ef7a560733d2bb93c5d0e8eae2
- SSDEEP 49152:iFIpI2IOXi8rfgEnC7EWVBqkzT3ltO/Ii2uRqpsHiWAKMV:iFxOy8rfoVBBv3f/NWiWAH
- TLSH T1F6C5236168DFF5D1EBA81234A9473E8B9605781F3DE9ECB235B234E72429EB008171D7
- MD5 SHA1 SHA512 SSDEEP TLSH