Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
- Size 11.6MB
- Sample260728-17ppcacb65
- SHA256 02233d1e47814b4739d18b72c24ca4e21de6bf61107b10282bfaa5dfd32a0afa
- MD5 b08962f9ba1d445dc9aba9660fda871c
- SHA1 83d127da816ee4207740f6c112cee1487f77d35b
- SHA512 1351ce6e5a7f528097b656169301569726983be6d6ec35c9e38b91631457ab0a22b466af85ca85c38a6cab7db6be5ef991b98e9d553fc6cfcbb79ca677989ade
- SSDEEP 196608:jeQNboguzDeQ2tP8Uxb1976gyMWZRFMLNKYyXf+BrjjG/j7Sr5Na6X9I4BMxHZ9H:jefhDMNxt76nZRFMLMYXM/jWbaD4WHZl
- TLSH T128C633302AAFD762F2A07231DA72F4551A842A40E0C4ED8BD954D71F7D73BA1B4618DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\License.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\AssertResolve.xlsb.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\tipresx.dll.mui.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\readme.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\History.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_b08962f9ba1d445dc9aba9660fda871c_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 11.6MB
- SHA256 a1c9088d230cb5ed8fd80c4691e5c9c88bcee6b67ae41691b6871cc80dd4b9d5
- MD5 10d37b3ecc66c764a2c0bdd33e6d7559
- SHA1 54e0a3324cf8d785744873d1705426e04b08d686
- SHA512 c1efbd6d3765ab15c10d9b05ae6f9fff91d9ef1695c86dc044e605bfbe659e4466226eeeca20caff82c0b13db29833e515778e71f55b4e048aaa0a3513e9aead
- SSDEEP 196608:jeQNboguzDeQ2tP8Uxb1976gyMWZRFMLNKYyXf+BrjjG/j7Sr5Na6X9I4BMxHZ9a:jefhDMNxt76nZRFMLMYXM/jWbaD4WHZ0
- TLSH T128C633302AAFD762F2A07231DA72F4551A842A40E0C8ED8BD954D71F7D73BA1B4618DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 11.7MB
- SHA256 bfe75795337968fec9692a60ec14ce50117617a610fab3f4c572a7a6cbe31d88
- MD5 fbac74c425406800bacc9f9586b1c4b0
- SHA1 1180b7602c0ea2e6b42f8e1aed0d095b4e2820eb
- SHA512 358eb4e7090d107672e9554ad7a1f8b37d5f4c0e790275a039856b2cb20a602be3269d8fe5526ac44bc293b92171e615ce411214b8c9622ebd1978aa9dddfc13
- SSDEEP 196608:jeQNboguzDeQ2tP8Uxb1976gyMWZRFMLNKYyXf+BrjjG/j7Sr5Na6X9I4BMxHZ9k:jefhDMNxt76nZRFMLMYXM/jWbaD4WHZG
- TLSH T142C633203DAFF761F7902231AA63BD4357403A44BCC8DD47E660D66B6D32AA168634DB
- MD5 SHA1 SHA512 SSDEEP TLSH