Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 22:53
Behavioral task
behavioral1
Sample
2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
- Size 60KB
- Sample260728-2t5dbabl81
- SHA256 1860b20fad7a1dc55e97fb7311a0006ee8a55c9fa35f45ae50f4e704e194d8c7
- MD5 6412cbd05a514973c9b1d4ed7d5fc4e4
- SHA1 1a1f9c7f21236b04b558ca774e65e35c8c4043b0
- SHA512 1c3e72ba85a0c6cfb545a916663bb7f947686a5b10f59d41a0d632028e601eb625e09321165b25685a13a923ec66a1078ea1b37bd97a40baec984c7957e61de3
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBu:/7ZQpApze+eJfFpsJOfFpsJ5DG
- TLSH T1D3535C4B9725C153E26D7A34AE2638B8BCD1409D612EFCEFFA16CD836D118B1670BD09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4800-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral1/files/0x00100000000231f3-2.dat family_cosmu behavioral1/files/0x0006000000021914-6.dat family_cosmu behavioral1/memory/4800-568-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4899) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\OLJRNL.FAE.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\it.pak.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsBase.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\libGLESv2.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mset7tkjp.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Luna.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Controls.Ribbon.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsFormsIntegration.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SIGNL.ICO.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\WindowsBase.resources.dll.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3053180483-1881419501-3594244048-1000\desktop.ini.tmp
- Size 60KB
- SHA256 ea304396cbd8ed2c3db988701d24b6acd2309d956f2f0cfb26eef4ca5d375648
- MD5 eaa086c6b7a0195c65ce4a011579de4b
- SHA1 1d55e352919c088355b8d5bdf25363db7b3aa30d
- SHA512 b16716d6cf67c729de87c1936f84f65ec8b4e5ab2012717a0cbfc6a6e0832f3649f8fdce98e704feada1ae9cfce8896b8af27c06dc4ff0d7380ff76753f05874
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXB9:/7ZQpApze+eJfFpsJOfFpsJ5DF
- TLSH T1D7535C4B9725C053E26D7A34AE2738B8BCD1409D612EFCEFFA16CDC36D118B1660B919
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 159KB
- SHA256 bdbaaf3821723acab52bf4205a6b75fdaa920304bb0cc92756f9b2591bbf0bc6
- MD5 8327a5ba5aab2df32e9ea96bdc541388
- SHA1 619023778a6e158047a6c05b30b253cdcc16a2f1
- SHA512 69e393669b23ad585d34429d6f9a5cb76ceba110972c20302ec7391688846c79a92c04dceadc85b7f892df2caf15e1deec5a4e482fe3cf9853577870ca47c06a
- SSDEEP 3072:9QWpze+eJfFpsJOfFpsJ5Ds5ZMfTiu66I3UwqSsMBlsWb4A+b:Lpe+ewD+MfTinqncsWp+b
- TLSH T1CBF317517D6EF2A0CB482339AE2B7EB3D201358F3C5ACD86B665C5E39138D910C5B4E6
- MD5 SHA1 SHA512 SSDEEP TLSH