Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 22:29
Behavioral task
behavioral1
Sample
2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
- Size 66KB
- Sample260728-2eppbaar6x
- SHA256 229819e9beae0c800a1893c77fe2430da80be623d2041f50568de32d5dcdd9d3
- MD5 968bb59cf1286ccb861a23425c227a23
- SHA1 d9158c0c65b69b937cec9c5bce1f8bb39447fcc5
- SHA512 f2166f23324d4492d9710901ed7a32488e560c26e6355174dd66469418cd1e6a685f8be5c56d8e69ffa2aaded982c818f25a09b6ddea000870779663b05be356
- SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBw6C/40C/F82:/7ZQpApP2KCg0Cr
- TLSH T1F463090B4A14C85FF33AA3B69C6A3075410674CD6B9EAFF2AD15CDC90C28D7346A791E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/2640-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral1/files/0x00050000000168c1-2.dat family_cosmu behavioral1/files/0x000400000002184a-6.dat family_cosmu behavioral1/memory/2640-536-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4914) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\OUTEX.ECF.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\7-Zip\descript.ion.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationCore.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationUI.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MAPIR.DLL.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Forms.Design.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.DispatchProxy.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPORT.CFG.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationTypes.resources.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Extensions.dll.tmp 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini.tmp
- Size 66KB
- SHA256 a430b9174367637b279ff56a1633793aab959ae3146e33150769b174065fd062
- MD5 617a3b8a38e779f59fbe7a4f76f9848e
- SHA1 de5764268d411e138f4e234fc0f54d8dca8b63d7
- SHA512 489afdf7a6aca403742f85450dced21728d34d03e9ce6638062a1ddcd790635efc10a9a52baea4f5bd845401b751befb5e79d8534d1cbfb76baf42f773c59a21
- SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBw6C/40C/F8Cx:/7ZQpApP2KCg0C7
- TLSH T18E63180B4A14C85FF33AA3B69C6A3075410634CD6B9EAFF2AD15CDC90C28D7306A791E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 165KB
- SHA256 807d76fb6c1d25fd4f3de9fe57aa4a19d1e895104dad9ee4f28382d82fd564fe
- MD5 1f73e124d1758c17634ee856b1a41ca2
- SHA1 d6ca20cf3100ca68dcddb69ff29a5ede7edc1248
- SHA512 0321e4fd43e8a7c28ccb2dd22fc3ba37d87a377da2b591ebbfef1f1627c68373681b0add87ee1ab3bed28abb21fec2b9dd5b592b62d256bbecb3b0a567800ef0
- SSDEEP 3072:9QWpP2n5ZMfTiu66I3UwqSsMBlsWb4A+Y:LB2/MfTinqncsWp+Y
- TLSH T10CF316116CAEF665CB141379AD5B2DB38201388E3D4ECEB2BA65D5E3443CDB20C974E6
- MD5 SHA1 SHA512 SSDEEP TLSH