Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
- Size 13.6MB
- Sample260728-2wlc8acd26
- SHA256 6b83134a5f4afbdb34a0117c7d2ca443d75885c4ac16d54452c1cd1bf660cf8a
- MD5 5de254f14b7f59aed8fe5b7afd4db277
- SHA1 2888022c76213fef1dcf0f547cb4cc441c9dc99c
- SHA512 db4daf5f6228cee191ba7936a15a2d1d6b8b94b718340f0d7f9a4bbd935dd322f3ba6c3da5d43c020a7393c639e97b312bbfe32d118c20bfc370952425e8ea01
- SSDEEP 393216:OefhDMNxt76nZRFMLMYXM/jWbaD4WHZc3C0CDePpNbDhDj:phDMPAnbFMYBjWbaDlHcdpHP
- TLSH T11DE63330569AB361F3A461309B61F9512E947E50F0D0EDDBE9018B2B6EB2F91F425CCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.exe.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini.tmp
- Size 13.6MB
- SHA256 fc5b745ce9e062e2de32251a0758ce483b48647ff12964546ea341396ba8b091
- MD5 ecaa179ece45e6ee6f770aea48ff72e4
- SHA1 6e064cbefa41969880e16d41ec0b433939b34531
- SHA512 39ecfd3a52bc2ee193d3c826b9fd9a86817dcfb05e423edd73997e5496949cb84def3a74505dc681a9f2ad70a34c0609145d7d37b3115d1308ff7ed53caac75c
- SSDEEP 393216:OefhDMNxt76nZRFMLMYXM/jWbaD4WHZc3C0CDePpNbDhDr:phDMPAnbFMYBjWbaDlHcdpHX
- TLSH T1DBE63330569AB361F3A461309B62F9512E947E50F0D0EDDBE9018B2B6DB2F91F425CCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 13.7MB
- SHA256 5decb338d24d958637f605a65aecc5e0b36d8980bb214a8319f46d3cf07f5e6b
- MD5 608d2a613c7308741003928ff071b41b
- SHA1 b5d4678383856c795e450334a369ecae71d6c8e1
- SHA512 2b6a9d76d2f1fad6d87050caa4a01e12badca8625629906b40d4153b820310f842edf7438fb3699f632cf02b0bc9f3735c42d54e328a393726c9586031c329dc
- SSDEEP 393216:OefhDMNxt76nZRFMLMYXM/jWbaD4WHZc3C0CDePpNbDhDc:phDMPAnbFMYBjWbaDlHcdpHA
- TLSH T16AE6333079AEF361EB942230AA63FE439E443D50BCC4DD87AA114767AD71F9168278C7
- MD5 SHA1 SHA512 SSDEEP TLSH