Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:56
Behavioral task
behavioral1
Sample
2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe
- Size 68KB
- Sample260728-2w6ddsbm4v
- SHA256 6b7f6ff704e051bb6dcc5bbea4e512307cd1a9620f500544f70a1c7e7165448c
- MD5 5b73834028099a0789ca2f7369df4db1
- SHA1 d4aa9bfc4c3a4b264fb0484bfacb0d630a157f21
- SHA512 adcea400714a7392a32a876af480f1401f6f8e7be7243f4a8963abe691f74504efecff40e35d8b95bd3a80c7e4d5b4a40791bc5b8f16491525ae3cb07d350b29
- SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBwvqJFqJiKpVKpxWs:/7ZQpApP2I+iKpVKp/
- TLSH T14F63090E4658986FF73AA7B79CA634BD414514CCAF5EBEB16D19CEC60C38D33412642E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/1080-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000a000000019cb8-2.dat family_cosmu behavioral2/files/0x000400000001b1cd-7.dat family_cosmu behavioral2/memory/1080-541-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\WindowsFormsIntegration.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\Logo.png.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.HttpUtility.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th.pak.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Handles.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Primitives.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\d3dcompiler_47.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_5b73834028099a0789ca2f7369df4db1_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini.tmp
- Size 69KB
- SHA256 877e57b34f616b5296615bcacea67cf7f54c9042a0f8f52c82fd74b695248f45
- MD5 172f783e681dbe1502eb05518b9ef264
- SHA1 d7638746e23406db3e0da88de57d5f1562827581
- SHA512 bd5bf36e0f600547dd838bb1285c596a110bc6d5ff66a3fad3ea9ff5a347c1b5a5e4896cb364b39a880c5d8873337ddc24ea2e733fbee7eb723f1e67a1ed2885
- SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBwvqJFqJiKpVKpxWR:/7ZQpApP2I+iKpVKpu
- TLSH T1FB63190E4658986BF73AA7B79CA634BD414514CCAF1EBEB1BE19DEC60C38D33412642D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 167KB
- SHA256 bbcb162b9cd1363fa25e79e031a3fe42e7fea651ea2d4ce4a9d106b5470c624a
- MD5 1e5fb92497b43e06f32d3c1dd8ad7d9c
- SHA1 94fa2df6a0f3efb8014f86882f7e30b6527588d1
- SHA512 2c02cdf1748d6919c9d75b283c3a99b4a76f8dea48dd7075d1d6c88bbe5590a4b44d196cd98d30a6071c27a1047340d5bec8cbcf6e73ec2001a8d9cf77d0053f
- SSDEEP 3072:9QWpP2TWJ5ZMfTiu66I3UwqSsMBlsWb4A+R:LB2GMfTinqncsWp+R
- TLSH T17DF306117CAEF665CB14237AAD5B2DB78200388E3D4ACE727A65D9E3443CD720C5B4E6
- MD5 SHA1 SHA512 SSDEEP TLSH