Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 23:03
Behavioral task
behavioral1
Sample
2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe
- Size 90KB
- Sample260728-2127jaycqb
- SHA256 689d0af89b621fc472bf53408943cedc4205a7d7a2d86c5511ba20fe22f902a3
- MD5 4c2313589dbdbc60b6073efb564a8ff2
- SHA1 82eeed7623256d305ce8156420a7192e80345d58
- SHA512 3aa5f043aee17841bf3f4cd96b815d10b76f25436714a769b3c5b24e76634436cf96d23f2cd9892ae3ea7337e04244c17446a76f686aad9aa12b381aa2ba1d98
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKs/3:69WpQE0zf3
- TLSH T1A593E51EAB9CC3EEC16B2730D42340B14E67A90B3F76EEE1B7D4D85C6825720645A937
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000600000001b714-10.dat family_cosmu behavioral2/files/0x000d00000001c405-13.dat family_cosmu - Renames multiple (3937) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3548 _taskrun.exe 2596 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\D3DCompiler_47_cor3.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Parallel.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\coreclr.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationNative_cor3.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.IsolatedStorage.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1856 wrote to memory of 3548 1856 2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe 88 PID 1856 wrote to memory of 2596 1856 2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_4c2313589dbdbc60b6073efb564a8ff2_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\_taskrun.exe"_taskrun.exe"2⤵
- Executes dropped EXE
PID:3548
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2596
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 84KB
- SHA256 b2223a4fd0f350aa233b64d8c961c33b994613e9514d3e7e307df5a175f83326
- MD5 8393809d2788798e250180ffc923008c
- SHA1 8a96b73602cffaa97b449edd6cd78efda7d1a64c
- SHA512 de9fa9791225f1a5de6aeca43ff73120bc55ac65e9593693ae4a9de2656230a39423e0d03dbc488496b9b2935bc0cebc6923b61a005de2550fc1bab357006903
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKU:69WpQE0zB
- TLSH T19583E41EAA5CC3EEC16B3330D02384B54D6BA90B3F75EEE1B7D4D86C6861720645A837
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_taskrun.exe
- Size 7KB
- SHA256 aa0b4f00af4d44a4944d81e2771fadeba8db0889665659528f804e0a9d3274f7
- MD5 fff35d3d88a66f7d311ea1d1a380d062
- SHA1 cf6124e88302d028d7deb5c8dfd6065b90089510
- SHA512 3be4e9b92e3ff33962c36f8b982c8acf72ba16bce412052f7dcbe3e95d4b2dafaab6e040e51258b8b16b7bd13341401f35dea7676395a9fc14cc7a0ba434dc5c
- SSDEEP 96:bn66+nzrDdbAVMPcJaSGLu+RmSoflpT9pSkCF5VbwWVD9CPfWlkbBzNt:jyNzGRG6WmJthTPCxUWTyfWCf
- TLSH T1DAE18314D3E40637EDF70FB1ECA30240A732FB159C37C76E6888114BA92678447726A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 83KB
- SHA256 14c6b448457b350c192b19371b93adb93b4cbb5aa37297384601a75f3c297b0d
- MD5 6df8291d8446fbb9fff324f3c5fbd547
- SHA1 d799a9a61d2c0902a17732609ea89905d7acdddb
- SHA512 8b1e2cdbd829df031954608af27416cb1d2b74d1b84c970c880620ff87a0e1cbfdf96b6d9f26ae5b513d0346b0853ed96705f5b6b2e9f8d8fced2dc3197be8b1
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKq:69WpQE0z/
- TLSH T11D83E41EAA5CC3EEC16B3730C02384B54D6BA90B3F75EEE1B7D4D86C6861720645A837
- MD5 SHA1 SHA512 SSDEEP TLSH