Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:15
Behavioral task
behavioral1
Sample
2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe
- Size 103KB
- Sample260728-16d68axdph
- SHA256 dc50a6ae1e2951dce98a6162f3db3938f092ca407d796ccb6a42a53cf7d721f6
- MD5 b493c1432010ed5e0e1cfea7297b6c07
- SHA1 ffc84e7f91e5ba11160d11a25b90f457cf2c8299
- SHA512 369640f8c4efcc0930e9018ba44871f99950d6135f75086b77cfe8bbc4684fd2359121c4f91c25f1a3cd113409889edef464260ec684d743fe076bb8e622acac
- SSDEEP 3072:fnyiQSoJUBM+PocOQejPdMRAHAASnnD5D5172HyZU3YF40S5DnumSFDnDHaJP1Be:KiQSo/6
- TLSH T1CFA3E835DFF8A82FF4A9593885AB2E6CCD339EC5BF6CFCA56A6029D44C907C1560104B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/6032-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral2/files/0x000b000000011377-2.dat family_cosmu behavioral2/files/0x000400000001b1cd-6.dat family_cosmu behavioral2/memory/6032-556-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Renames multiple (4182) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/6032-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000b000000011377-2.dat UPX behavioral2/files/0x000400000001b1cd-6.dat UPX behavioral2/memory/6032-556-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/6032-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000b000000011377-2.dat upx behavioral2/files/0x000400000001b1cd-6.dat upx behavioral2/memory/6032-556-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationCore.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.RegularExpressions.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\msquic.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClient.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja.pak.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationUI.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.DriveInfo.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationClient.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR.pak.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\tipresx.dll.mui.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pa-IN\tipresx.dll.mui.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwstaging.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg.pak.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Expressions.dll.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_b493c1432010ed5e0e1cfea7297b6c07_coinminer_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:6032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini.tmp
- Size 104KB
- SHA256 a3eb74d98de444b18d62aed8345f3672ee5dc6090910e73e4b2af1e1e3920112
- MD5 cf2aa05ccb7178b74ceb02349357abd0
- SHA1 34d73a3ddbe944df27dfcde0b50f6f3c3fdc054e
- SHA512 558d3657664aa8ddda8049394e81c171d1b508e55f853a96ac951db35ea38db2bedfea1c5d2bef2f6145d2b6e179b03fa8db6862c0a111b9d1c7566ebd6d7e05
- SSDEEP 3072:fnyiQSoJUBM+PocOQejPdMRAHAASnnD5D5172HyZU3YF40S5DnumSFDnDHaJP1BD:KiQSo/v
- TLSH T16DA3E835DFF8A82FF4A9593885AB2E6CCD339EC5BF6CFCA56A6029D44C907C1560104B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 202KB
- SHA256 4546582f8d90b7b4fdc3f53446d7f41fed7b734d08da61d2f950c46792db3eec
- MD5 d4a9509d98b998bb9ea32fe4bd7141a6
- SHA1 ef7133b88a7021c5c4b6deb146663fb0556a093d
- SHA512 a8b2372bc0154ba557fe6518184d6dbb99850e9347e4107af2650fc42c05954362d2703d098aa98be0c37ec35a6488226891d39990a3377b8f6714a2fc574318
- SSDEEP 3072:fnyiQSoJUBM+PocOQejPdMRAHAASnnD5D5172HyZU3YF40S5DnumSFDnDHaJP1Bk:KiQSo/wMfTinqncsWp+W
- TLSH T1C2141830AFFDF56ADA541238996B2E8BCE127DCA3F5DDD527A7015E28C28AC108470D7
- MD5 SHA1 SHA512 SSDEEP TLSH