Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 21:47
Behavioral task
behavioral1
Sample
2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe
- Size 105KB
- Sample260728-1m95jswhqa
- SHA256 8d4e427d76201ded16663f04076689e7f03a08305a48bea0f9b76ac621b7840e
- MD5 f27283de807a75c7acf35fec61408feb
- SHA1 2c8df882cca25695b906c4810467ab661008138e
- SHA512 db2f9706ef6966ad0ef3df1cbcf12a9440d874e157080bb70a6ed90bb7b1f479bc09039d3c48eadb955fb4ac89d0156156fb7daac5f030f1f29d8f988258153a
- SSDEEP 3072:9QWpze+eO888888888888888888888888888888888888888888888888888888w:Lpe+ekeq1m
- TLSH T168B349597B92FC42D2993DF3C816013CEDA35C983195EC46FA34F8F66A488B0512B7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2600-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000a000000016cdf-2.dat family_cosmu behavioral2/files/0x000400000001b1ed-6.dat family_cosmu behavioral2/memory/2600-516-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationCore.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationUI.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.DataSetExtensions.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\ColleagueImport.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.HttpUtility.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Design.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ServiceModel.Web.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_f27283de807a75c7acf35fec61408feb_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 106KB
- SHA256 21bc5743172879ea6705f1db5d0feb5b2831f2f33a7ab8684d636acc6f590461
- MD5 ca434ff08d9e2a11c0a0e3535e35841a
- SHA1 2e4ce217df6143d911c1843be775f98caf5f3e01
- SHA512 e9e5566f97d02dcd634194b454249aff2c07977fec11a90f5accf387cdc415cf0f504311649fe956a851ce7ec34a94601c2eb76f153870366467a2d5f66fc01b
- SSDEEP 3072:9QWpze+eO888888888888888888888888888888888888888888888888888888m:Lpe+ekeq1M
- TLSH T101B338597B92FC42D2993DF3C816113CED934C9831A5EC46FA34F8F66A488B0512B7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 204KB
- SHA256 d43e97578e7f9d135e681462548decb77d655d15704cb89b06f1b763ecf46ded
- MD5 f6dd0107164ed2388cf91bb6cc91e786
- SHA1 3be361ece471fdc8aea55c0d1dd42843944f0691
- SHA512 f09312a1ce51ef2da8af03f840180df2f0bae06ab8aa277e25b3bdc659f099dd634e9d3af197c56feb223206db9e1ebe98e48c28bff63e959305be905e921c5b
- SSDEEP 3072:9QWpze+eO8888888888888888888888888888888888888888888888888888885:Lpe+ekeq1GMfTinqncsWp+H
- TLSH T1FD2439507EAAF950CB8826B6ED175D7FDE022D8A3C59CC42B674F4F3552C8A0085B6E3
- MD5 SHA1 SHA512 SSDEEP TLSH