Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
- Size 11.6MB
- Sample260728-17ppcacb65
- SHA256 02233d1e47814b4739d18b72c24ca4e21de6bf61107b10282bfaa5dfd32a0afa
- MD5 b08962f9ba1d445dc9aba9660fda871c
- SHA1 83d127da816ee4207740f6c112cee1487f77d35b
- SHA512 1351ce6e5a7f528097b656169301569726983be6d6ec35c9e38b91631457ab0a22b466af85ca85c38a6cab7db6be5ef991b98e9d553fc6cfcbb79ca677989ade
- SSDEEP 196608:jeQNboguzDeQ2tP8Uxb1976gyMWZRFMLNKYyXf+BrjjG/j7Sr5Na6X9I4BMxHZ9H:jefhDMNxt76nZRFMLMYXM/jWbaD4WHZl
- TLSH T128C633302AAFD762F2A07231DA72F4551A842A40E0C4ED8BD954D71F7D73BA1B4618DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\chrome_installer.log.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-668679576-120646659-2289335452-1000\desktop.ini.tmp
- Size 11.6MB
- SHA256 339ecef3f96219ee255789431704a84587af65d144546fe3ad81c01c8fb21598
- MD5 cd4a646ad915727e97e352dd6f6b3b9b
- SHA1 1b94e3db6cee57cf101d6fd752be52c95b523fbd
- SHA512 f577659d38bab371d3f0d8554b788ee2edd8474a498f9b35bd8fca1ed1a5e86b69015a7983e08412ba0ad0892e901a889c8eb85395e8f2b380b0eea90852875a
- SSDEEP 196608:jeQNboguzDeQ2tP8Uxb1976gyMWZRFMLNKYyXf+BrjjG/j7Sr5Na6X9I4BMxHZ9s:jefhDMNxt76nZRFMLMYXM/jWbaD4WHZG
- TLSH T1A7C633302AAFD762F2A07231DA72F4551A842A40E0C4ED8BD954D71F7D73BB1B4618DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 11.7MB
- SHA256 0ff842d057fba094440bc05d43e190489178bc75f4f962b8e9ffbc410ae8e32a
- MD5 af4583afd48843a4e7fe11d32a5acd4d
- SHA1 08a0226baa7c78b6ebe9d0b7e7f7a08e190d72b8
- SHA512 c0703593a758549e8aaa2abacda344e92b981e11452654151ba374625a7b814f50c0ba1bd0f82c6d792b9fccf17e7a19c3f7561ca7b997cfd094abd21587144f
- SSDEEP 196608:jeQNboguzDeQ2tP8Uxb1976gyMWZRFMLNKYyXf+BrjjG/j7Sr5Na6X9I4BMxHZ9k:jefhDMNxt76nZRFMLMYXM/jWbaD4WHZq
- TLSH T192C633203DAFF361F7902231AA63BD4357443A44BCC8DD47E660D66B6D32EA168634DB
- MD5 SHA1 SHA512 SSDEEP TLSH